aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* toolchain: Update GCC 10 to version 10.2.0DENG Qingfang2020-08-3120-4/+4
| | | | Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
* toolchain/binutils: add binutils 2.35DENG Qingfang2020-08-316-0/+90
| | | | | | Add binutils version 2.35 Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
* checkpolicy: build-depend on libselinuxDaniel Golle2020-08-311-0/+1
| | | | | | | | | | | | Static libraries and headers of libselinux and libsepol are required for checkpolicy to build. Fixes error: policy_parse.y:45:10: fatal error: sepol/policydb/expand.h: No such file or directory #include <sepol/policydb/expand.h> ^~~~~~~~~~~~~~~~~~~~~~~~~ compilation terminated. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* policycoreutils: fix i18n dependsDaniel Golle2020-08-311-1/+1
| | | | | | | | | | Fixes build error: load_policy.c:11:10: fatal error: libintl.h: No such file or directory #include <libintl.h> /* for gettext() */ ^~~~~~~~~~~ compilation terminated. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ath79: add support for Senao Engenius ENH202 v1Michael Pratt2020-08-316-13/+225
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FCC ID: U2M-ENH200 Engenius ENH202 is an outdoor wireless access point with 2 10/100 ports, built-in ethernet switch, internal antenna plates and proprietery PoE. Specification: - Qualcomm/Atheros AR7240 rev 2 - 40 MHz reference clock - 8 MB FLASH ST25P64V6P (aka ST M25P64) - 32 MB RAM - UART at J3 (populated) - 2x 10/100 Mbps Ethernet (built-in switch at gmac1) - 2.4 GHz, 2x2, 29dBm (Atheros AR9280 rev 2) - internal antenna plates (10 dbi, semi-directional) - 5 LEDs, 1 button (LAN, WAN, RSSI) (Reset) Known Issues: - Sysupgrade from ar71xx no longer possible - Power LED not controllable, or unknown gpio MAC addresses: eth0/eth1 *:11 art 0x0/0x6 wlan *:10 art 0x120c The device label lists both addresses, WLAN MAC and ETH MAC, in that order. Since 0x0 and 0x6 have the same content, it cannot be determined which is eth0 and eth1, so we chose 0x0 for both. Installation: 2 ways to flash factory.bin from OEM: - Connect ethernet directly to board (the non POE port) this is LAN for all images - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop or halt which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" In upper right select Reset "Restore to factory default settings" Wait for reboot and login again Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt boot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9f670000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will not work DO NOT downgrade to ar71xx this way, can cause kernel loop or halt The easiest way to return to the OEM software is the Failsafe image If you dont have a serial cable, you can ssh into openwrt and run `mtd -r erase fakeroot` Wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade Format of OEM firmware image: The OEM software of ENH202 is a heavily modified version of Openwrt Kamikaze bleeding-edge. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-senao-enh202-uImage-lzma.bin openwrt-senao-enh202-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring, and by swapping headers to see what the OEM upgrade utility accepts and rejects. OKLI kernel loader is required because the OEM firmware expects the kernel to be no greater than 1024k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on built-in switch: ENH202 is originally configured to be an access point, but with two ethernet ports, both WAN and LAN is possible. the POE port is gmac0 which is preferred to be the port for WAN because it gives link status where swconfig does not. Signed-off-by: Michael Pratt <mpratt51@gmail.com> [assign label_mac in 02_network, use ucidef_set_interface_wan, use common device definition, some reordering] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for Senao Engenius ENS202EXT v1Michael Pratt2020-08-315-2/+239
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports, with built-in ethernet switch, detachable antennas and proprietery PoE. FCC ID: A8J-ENS202 Specification: - Qualcomm/Atheros AR9341 v1 - 535/400/200/40 MHz (CPU/DDR/AHB/REF) - 64 MB of RAM - 16 MB of FLASH MX25L12835F(MI-10G) - UART (J1) header on PCB (unpopulated) - 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229) - 2.4 GHz, up to 27dBm (Atheros AR9340) - 2x external, detachable antennas - 7x LED (5 programmable in ath79), 1x GPIO button (Reset) Known Issues: - Sysupgrade from ar71xx no longer possible - Ethernet LEDs stay on solid when connected, not programmable MAC addresses: eth0/eth1 *:7b art 0x0/0x6 wlan *:7a art 0x1002 The device label lists both addresses, WLAN MAC and ETH MAC, in that order. Since 0x0 and 0x6 have the same content, it cannot be determined which is eth0 and eth1, so we chose 0x0 for both. Installation: 2 ways to flash factory.bin from OEM: - Connect ethernet directly to board (the non POE port) this is LAN for all images - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" In upper right select Reset "Restore to factory default settings" Wait for reboot and login again Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt boot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fdf0000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes *If you are unable to get network/LuCI after flashing* You must perform another factory reset: After waiting 3 minutes or when Power LED stop blinking: Hold Reset button for 15 seconds while powered on or until Power LED blinks very fast release and wait 2 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions *DISCLAIMER* The Failsafe image is unique to this model. The following directions are unique to this model. DO NOT downgrade to ar71xx this way, can cause kernel loop The easiest way to return to the OEM software is the Failsafe image If you dont have a serial cable, you can ssh into openwrt and run `mtd -r erase fakeroot` Wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade TFTP Recovery: For some reason, TFTP is not reliable on this board. Takes many attempts, many timeouts before it fully transfers. Starting with an initramfs.bin: Connect to ethernet set IP address and TFTP server to 192.168.1.101 set up infinite ping to 192.168.1.1 rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server disconnect power to the board hold reset button while powering on board for 8 seconds Wait a minute, power LED should blink eventually if successful and a minute after that the pings should get replies You have now loaded a temporary Openwrt with default settings temporarily. You can use that image to sysupgrade another image to overwrite flash. Format of OEM firmware image: The OEM software of ENS202EXT is a heavily modified version of Openwrt Kamikaze bleeding-edge. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-senao-ens202ext-uImage-lzma.bin openwrt-senao-ens202ext-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring, and by swapping headers to see what the OEM upgrade utility accepts and rejects. Note on the factory.bin: The newest kernel is too large to be in the kernel partition the new ath79 kernel is beyond 1592k Even ath79-tiny is 1580k Checksum fails at boot because the bootloader (modified uboot) expects kernel to be 1536k. If the kernel is larger, it gets overwritten when rootfs is flashed, causing a broken image. The mtdparts variable is part of the build and saving a new uboot environment will not persist after flashing. OEM version might interact with uboot or with the custom OEM partition at 0x9f050000. Failed checksums at boot cause failsafe image to launch, allowing any image to be flashed again. HOWEVER: one should not install older Openwrt from failsafe because it can cause rootfs to be unmountable, causing kernel loop after successful checksum. The only way to rescue after that is with a serial cable. For these reasons, a fake kernel (OKLI kernel loader) and fake squashfs rootfs is implemented to take care of the OEM firmware image verification and checksums at boot. The OEM only verifies the checksum of the first image of each partition respectively, which is the loader and the fake squashfs. This completely frees the "firmware" partition from all checks. virtual_flash is implemented to make use of the wasted space. this leaves only 2 erase blocks actually wasted. The loader and fakeroot partitions must remain intact, otherwise the next boot will fail, redirecting to the Failsafe image. Because the partition table required is so different than the OEM partition table and ar71xx partition table, sysupgrades are not possible until one switches to ath79 kernel. Note on sysupgrade.tgz: To make things even more complicated, another change is needed to fix an issue where network does not work after flashing from either OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze) configuration into the jffs2 /overlay when writing rootfs from factory.bin. The upgrade script has this: mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs" However, it also accepts scripts before and after: before_local="/etc/before-upgradelocal.sh" after_local="/etc/after-upgradelocal.sh" before="before-upgrade.sh" after="after-upgrade.sh" Thus, we can solve the issue by making the .tgz an empty file by making a before-upgrade.sh in the factory.bin Note on built-in switch: There is two ports on the board, POE through the power supply brick, the other is on the board. For whatever reason, in the ar71xx target, both ports were on the built-in switch on eth1. In order to make use of a port for WAN or a different LAN, one has to set up VLANs. In ath79, eth0 and eth1 is defined in the DTS so that the built-in switch is seen as eth0, but only for 1 port the other port is on eth1 without a built-in switch. eth0: switch0 CPU is port 0 board port is port 1 eth1: POE port on the power brick Since there is two physical ports, it can be configured as a full router, with LAN for both wired and wireless. According to the Datasheet, the port that is not on the switch is connected to gmac0. It is preferred that gmac0 is chosen as WAN over a port on an internal switch, so that link status can pass to the kernel immediately which is more important for WAN connections. Signed-off-by: Michael Pratt <mpratt51@gmail.com> [apply sorting in 01_leds, make factory recipe more generic, create common device node, move label-mac to 02_network, add MAC addresses to commit message, remove kmod-leds-gpio, use gzip directly] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: mikrotik: fix network setup for lhg-hb platformRoger Pueyo Centelles2020-08-311-1/+10
| | | | | | | | | | | This network setup for MikroTik devices based on the LHG-HB platform avoids using the integrated switch and connects the single Ethernet port directly. This way, link speed (10/100 Mbps) is properly repor- ted by eth0. Fixes: FS#3309 Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
* ath79: use correct MAC address for TP-Link TL-WPA8630 v2Sven Wegener2020-08-311-2/+7
| | | | | | | | | The base address is used for the LAN and 2G WLAN interfaces. 5G WLAN interface is +1 and the PLC interface uses +2. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> [improve commit title, fix assignment in 11-ath10k-caldata] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for Meraki MR16Martin Kennedy2020-08-316-0/+211
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Port device support for Meraki MR16 from the ar71xx target to ath79. Specifications: * AR7161 CPU, 16 MiB Flash, 64 MiB RAM * One PoE-capable Gigabit Ethernet Port * AR9220 / AR9223 (2x2 11an / 11n) WLAN Installation: * Requires TFTP server at 192.168.1.101, w/ initramfs & sysupgrade .bins * Open shell case and connect a USB to TTL cable to upper serial headers * Power on the router; connect to U-boot over 115200-baud connection * Interrupt U-boot process to boot Openwrt by running: setenv bootcmd bootm 0xbf0a0000; saveenv; tftpboot 0c00000 <filename-of-initramfs-kernel>.bin; bootm 0c00000; * Copy sysupgrade image to /tmp on MR16 * sysupgrade /tmp/<filename-of-sysupgrade>.bin Notes: - There are two separate ARTs in the partition (offset 0x1000/0x5000 and 0x11000/0x15000) in the OEM device. I suspect this is an OEM artifact; possibly used to configure the radios for different regions, circumstances or RF frontends. Since the ar71xx target uses the second offsets, use that second set (0x11000 and 0x15000) for the ART. - kmod-owl-loader is still required to load the ART partition into the driver. - The manner of storing MAC addresses is updated from ar71xx; it is at 0x66 of the 'config' partition, where it was discovered that the OEM firmware stores it. This is set as read-only. If you are migrating from ar71xx and used the method mentioned above to upgrade, use kmod-mtd-rw or UCI to add the MAC back in. One more method for doing this is described below. - Migrating directly from ar71xx has not been thoroughly tested, but one method has been used a couple of times with good success, migrating 18.06.2 to a full image produced as of this commit. Please note that these instructions are only for experienced users, and/or those still able to open their device up to flash it via the serial headers should anything go wrong. 1) Install kmod-mtd-rw and uboot-envtools 2) Run `insmod mtd-rw.ko i_want_a_brick=1` 3) Modify /etc/fw_env.config to point to the u-boot-env partition. The file /etc/fw_env.config should contain: # MTD device env offset env size sector size /dev/mtd1 0x00000 0x10000 0x10000 See https://openwrt.org/docs/techref/bootloader/uboot.config for more details. 4) Run `fw_printenv` to verify everything is correct, as per the link above. 5) Run `fw_setenv bootcmd bootm 0xbf0a0000` to set a new boot address. 6) Manually modify /lib/upgrade/common.sh's get_image function: Change ... cat "$from" 2>/dev/null | $cmd ... into ... ( dd if=/dev/zero bs=1 count=$((0x66)) ; # Pad the first 102 bytes echo -ne '\x00\x18\x0a\x12\x34\x56' ; # Add in MAC address dd if=/dev/zero bs=1 count=$((0x20000-0x66-0x6)) ; # Pad the rest cat "$from" 2>/dev/null | $cmd ) ... which, during the upgrade process, will pad the image by 128K of zeroes-plus-MAC-address, in order for the ar71xx's firmware partition -- which starts at 0xbf080000 -- to be instead aligned with the ath79 firmware partition, which starts 128K later at 0xbf0a0000. 7) Copy the sysupgrade image into /tmp, as above 8) Run `sysupgrade -F /tmp/<sysupgrade>.bin`, then wait Again, this may BRICK YOUR DEVICE, so make *sure* to have your serial cable handy. Addenda: - The MR12 should be able to be migrated in a nearly identical manner as it shares much of its hardware with the MR16. - Thank-you Chris B for copious help with this port. Signed-off-by: Martin Kennedy <hurricos@gmail.com> [fix typo in compat message, drop art DT label, move 05_fix-compat-version to subtarget] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* libsemanage: new packageDaniel Golle2020-08-311-0/+66
| | | | | | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [update to 3.1] Signed-off-by: W. Michael Petullo <mike@flyn.org> [removed python part for inclusion in core] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* audit: new packageThomas Petazzoni2020-08-314-0/+302
| | | | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [fix build with GCC 10 and disable MIPS16 as build emits sync instruction] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* bpftools: add utility and library packages supporting eBPF usageTony Ambardar2020-08-315-0/+508
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for building bpftool and libbpf from the latest 5.8.3 kernel sources, ensuring up-to-date functionality and fixes. Both are written to be backwards compatible, which simplfies build and usage across different OpenWRT image kernels. 'bpftool' is the primary userspace tool widely used for introspection and manipulation of eBPF programs and maps. Two variants are built: a 'full' version which supports object disassembly and depends on libbfd/libopcodes (total ~500KB); and a 'minimal' version without disassembly functions and dependencies. The default 'minimal' variant is otherwise fully functional, and both are compiled using LTO for further (~30KB) size reductions. 'libbpf' provides shared/static libraries and dev files needed for building userspace programs that perform eBPF interaction. Several cross-compilation and build-failure problems are addressed by new patches and ones backported from farther upstream: * 001-libbpf-ensure-no-local-symbols-counted-in-ABI-check.patch * 002-libbpf-fix-build-failure-from-uninitialized-variable.patch * 003-bpftool-allow-passing-BPFTOOL_VERSION-to-make.patch * 004-v5.9-bpftool-use-only-ftw-for-file-tree-parsing.patch Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
* musl: add common glibc extention for nftwTony Ambardar2020-08-312-1/+103
| | | | | | | | | Add FTW_ACTIONRETVAL mode and update nftw library for walking file trees. Update needed to build bpftool userspace utility from Linux kernel source. Also increment PKG_RELEASE. Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
* build: switch VERSION_REPO to HTTPSPaul Spooren2020-08-312-2/+2
| | | | | | | | | | | The variable VERSION_REPO is used by opkg to download package(list)s. Now that the default installation support encrypted HTTP opkg should make use of it. Suggested-by: Petr Štetiar <ynezz@true.cz> Suggested-by: Baptiste Jonglez <baptiste@bitsofnetworks.org> Signed-off-by: Paul Spooren <mail@aparcar.org> Acked-by: Baptiste Jonglez <baptiste@bitsofnetworks.org>
* build: sort default packages and split by newlinesPaul Spooren2020-08-311-3/+32
| | | | | | | | The line of default packages became very long and it is easier to read one package per line, therefore split it by newlines and sort it alphabetically. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: add libustream and certs to default pkgsPaul Spooren2020-08-311-1/+1
| | | | | | | | | | | | | To allow HTTPS usage on a router it requires both certificates (ca-bundle) and a fitting libustream library (libustream-wolfssl) By adding both, uclient-fetch and wget can connect to encrypted HTTP. This allows opkg to update package lists in a more secure fashion. Suggested-by: Petr Štetiar <ynezz@true.cz> Suggested-by: Baptiste Jonglez <baptiste@bitsofnetworks.org> Signed-off-by: Paul Spooren <mail@aparcar.org>
* treewide: https for downloads.openwrt.org sourcesPaul Spooren2020-08-315-5/+5
| | | | | | | Instead of using http and https for source downloads from downloads.openwrt.org, always use https for it's better security. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: add whatdepends target to imagebuilderPaul Spooren2020-08-311-1/+9
| | | | | | | | | | | | | | | | The package manager `opkg` offers the function `whatdepends` to print packages that depend on a specific package. This feature is useful when used in a CI to not only build an upgraded package but all packages with a dependency. Usage: make whatdepends PACKAGE=libipset The resulting list can be fed into a SDK building all packages and warn if anything fails. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: store SourceDateEpoch in manifestPaul Spooren2020-08-312-1/+2
| | | | | | | | The usage of granular `SOURCE_DATE_EPOCH` for packages is an incrementing integer which could be useful for downstream tooling, therefore add it to the packages manifest. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: store granular timestamps in packagesPaul Spooren2020-08-312-9/+4
| | | | | | | | | | | | | | With the new `SOURCE` argument of `get_source_date_epoch` it is possible to set package timestamps based on actual package changes rather thane $TOPDIR changes. This commit adds a new variable PKG_SOURCE_DATE_EPOCH which is used by the `ipkg` build script. As a fallback the existing SOURCE_DATE_EPOCH is used or as last resort the current time. The redundant checks for `.git/` and `.svn/` are removed. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: get_source_date_epoch allow external reposPaul Spooren2020-08-311-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The SOURCE_DATE_EPOCH variable is used to make builds reproducible even if rebuild at different times. Instead of using the current timestamp, the time of the last source change is used. Created packages are `touch`ed with a specific timestamp so resulting packages have the same checksums. The `get_source_date_epoch.sh` script tries multiple ways (file, git, hg) to determine the correct timestamp. Until now the script would only consider the $TOPDIR instead of package specific changes. Resulting in packages with same versions but different timestamps, as $TOPDIR (openwrt.git) received changes not affecting package versions. This results in warning/erros in `opkg` as the package versions stay the same but checksums changed. This commit adds an optional argument to get the `SOURCE_DATE_EPOCH` of a specific path (e.g. package SOURCE) rather than the $TOPDIR. As a consequence this allows granular but still reproducible timestamps. As packages might be distributed over multiple repositories the check for `.git/` becomes unfeasible. Instead tell `git` and `hg` to change their working directories and automatically traverse the repo folder. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: Fix Shellcheck for get_source_date_epoch.shPaul Spooren2020-08-311-2/+5
| | | | | | | | If a `cd` to `TOPDIR` fails the script should quit. Also unify `try_mtime` function by storing it in a variable. Signed-off-by: Paul Spooren <mail@aparcar.org>
* busybox: Use PKG_FILE_MODES for SUIDPaul Spooren2020-08-311-4/+5
| | | | | | | Instead of using INSTALL_SUID use the more flexible PKG_FILE_MODES variable withn the Makefile to set the SUID bit. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: ipkg-build use fakeroot with PKG_FILE_MODESPaul Spooren2020-08-312-21/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `ipkg-build` script converts a folder into a `opkg` installable package. Until now it would use root:root for all packages and try to preserve file modes. This has the two drawbacks of packages want to add non-root files or add SUID files, like the `sudo` package does. To give more flexibility regarding file modes and avoid init script hacks, a new variable called `PKG_FILE_MODES`. The variable contains a list of files modes in the format `path:owner:group:mode`. An example for the `sudo` package below: ``` PKG_FILE_MODES:=\ /usr/bin/sudo:root:root:4755 \ /etc/sudoers:root:root:0440 ``` The `ipkg-build` now runs within a fakeroot environment to set any mode and directly store it in the resulting `ipk` package archive. Both options `-o` and `-g` are no longer required due to the introduction of the more flexible `-m` options, which takes the `PKG_FILE_MODES` as input. Lastly the option `-c` is removed as it's unused within the script. Signed-off-by: Paul Spooren <mail@aparcar.org>
* opkg: update to git HEADDaniel Golle2020-08-311-3/+3
| | | | | | | 4318ab1 opkg: allow to configure the path to the signature verification script cf44c2f libopkg: fix compiler warning Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* px5g: rename to px5g-mbedtlsPaul Spooren2020-08-312-2/+2
| | | | | | | | | | Two versions of `px5g` exists without sharing code. For clarification rename the previously existing MbedTLS based version to `px5g-mbedtls` to exists next to `px5g-wolfssl`. Rename code file of MbedTLS from `px5g.c` to `px5g-mbedtls.c`. Signed-off-by: Paul Spooren <mail@aparcar.org>
* px5g-wolfssl: add packagePaul Spooren2020-08-312-0/+404
| | | | | | | This package creates certificates and private keys, just like `px5g` does. Hower it uses WolfSSL rather than MbedTLS. Signed-off-by: Paul Spooren <mail@aparcar.org>
* wolfssl: add certgen config optionPaul Spooren2020-08-312-1/+6
| | | | | | The option allows to generate certificates. Signed-off-by: Paul Spooren <mail@aparcar.org>
* nghttp2: move to packages.gitHans Dedecker2020-08-311-44/+0
| | | | | | | | | As the package curl has been moved to packages.git and only libcurl depends on libnghttps move it as well to packages.git. This is based on the Hamburg 2019 decision that non essential packages should move outside base. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* refpolicy: new packageThomas Petazzoni2020-08-312-0/+87
| | | | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [update to 2.20200229, adjust Makefile, and move to openwrt.git] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* checkpolicy: new packageThomas Petazzoni2020-08-311-0/+51
| | | | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [update to 3.1, make use of Python 3, and move to openwrt.git] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* policycoreutils: new packageThomas Petazzoni2020-08-311-0/+83
| | | | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [update to 3.1, make use of Python 3, use ALTERNATIVES, and move to openwrt.git] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* kernel: add options needed for SELinuxThomas Petazzoni2020-08-312-0/+80
| | | | | | | | | | This adds a number of options to config/Config-kernel.in so that packages related to SELinux support can enable the appropriate Linux kernel support. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [rebase; add ext4, F2FS, UBIFS, and JFFS2 support; add commit message] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* tools/squashfskit4: add xattr support to mksquashfs for SELinuxThomas Petazzoni2020-08-311-1/+1
| | | | | | | | SELinux uses extended attributes to store SELinux security contexts. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [rebase, add commit message] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* build: add support for SELinux to include/image.mkThomas Petazzoni2020-08-312-1/+28
| | | | | | | | | This allows the build process to prepare a squashfs filesystem for use with SELinux. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [rebase, add commit message] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* tools: add back lzma-old for ath79David Bauer2020-08-311-1/+1
| | | | | | | | | lzma-old host package is required for building ath79 images, as mksquashfs-lzma is required for generating netgear images. Fixes commit 4e4ee4649553 ("ar71xx: drop target") Signed-off-by: David Bauer <mail@david-bauer.net>
* tools/coreutils: update to 8.32Hannu Nyman2020-08-302-27/+2
| | | | | | | Update coreutils to version 8.32. Remove upstreamed patch. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* leds: add activity led trigger kernel module packageSven Wegener2020-08-301-0/+14
| | | | | | | The activity trigger flashes like the heartbeat trigger, but adjusts based on system load. Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
* kernel: add missing symbol NET_DSA_TAG_RTL4_AHannu Nyman2020-08-301-0/+1
| | | | | | | Fix build breakage caused by the missing kernel config symbol. Fixes: 8735997686a3 ("kernel: backport RTL8366RB patches") Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* ethtool: Update to version 5.8Hauke Mehrtens2020-08-301-2/+4
| | | | | | | | | | | | The ipk sizes for mips_24Kc change like this: old: ethtool_5.4-1_mips_24kc.ipk 101.909 new: ethtool_5.8-1_mips_24kc.ipk 109.699 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Tested-by: Hans Dedecker <dedeckeh@gmail.com>
* iproute2: Update to version 5.8Hauke Mehrtens2020-08-306-89/+12
| | | | | | | | | | | | | | | The ipk sizes for mips_24Kc change like this: old: ip-full_5.7.0-2_mips_24kc.ipk 165.786 ip-tiny_5.7.0-2_mips_24kc.ipk 117.730 tc_5.7.0-2_mips_24kc.ipk 144.405 new: ip-full_5.8.0-1_mips_24kc.ipk 169.775 ip-tiny_5.8.0-1_mips_24kc.ipk 119.808 tc_5.8.0-1_mips_24kc.ipk 149.053 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* mac80211: Fix potential endless loopHauke Mehrtens2020-08-301-0/+31
| | | | | | Backport a fix from kernel 5.8.3. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ath79: increase kernel partition for ar9344 TP-Link CPE/WBSAdrian Schmutzler2020-08-303-26/+26
| | | | | | | | | | | | The kernel has become too big again for the ar9344-based TP-Link CPE/WBS devices which still have no firmware-partition splitter. Current buildbots produce a kernel size of about 2469 kiB, while the partition is only 2048 kiB (0x200000). Therefore, increase it to 0x300000 to provide enough room for this and, hopefully, the next kernel. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ar71xx: drop targetAdrian Schmutzler2020-08-30489-84828/+10
| | | | | | | | | | This target has been mostly replaced by ath79 and won't be included in the upcoming release anymore. Finally put it to rest. This also removes all references in packages, tools, etc. as well as the uboot-ar71xx and vsc73x5-ucode packages. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* wireguard-tools: add tunlink option for hostrouteAaron Goodman2020-08-302-2/+3
| | | | | | | | | | In a multi-wan setup, netifd may need guidance on which wan device to use to create the route to the remote peer. This commit adds a 'tunlink' option similar to other tunneling interfaces such as 6in4, 6rd, gre, etc. Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
* kernel: bump 5.4 to 5.4.61John Audia2020-08-3037-68/+65
| | | | | | | | | | | | | | | | | | | Manually merged: backport-5.4 011-kbuild-export-SUBARCH.patch layerscape 701-net-0262-net-dsa-ocelot-add-tagger-for-Ocelot-Felix-switches.patch All other modifications made by update_kernel.sh Build-tested: x86/64, lantiq/xrx200, ramips/mt7621 Run-tested: ipq806x (R7800), lantiq/xrx200, x86/64, ramips (RT-AC57U) No dmesg regressions, everything functional Signed-off-by: John Audia <graysky@archlinux.us> [minor commit message adjustments] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* apm821xx: fix typos in .dts filesChristian Lamparter2020-08-291-2/+2
| | | | | | | This patch fixes various typos or tab-vs-space issues in the APM821XX device targets Device-Tree source files. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* apm821xx: use SPDX-License-identifiersChristian Lamparter2020-08-298-50/+8
| | | | | | | Please note that the DTS are based on really old .DTS from vendors themselves. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* apm821xx: apm821xx.dtsi fix comment stylesChristian Lamparter2020-08-291-2/+4
| | | | Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* apm821xx: MX60W: enumerate PCIe in device-treeChristian Lamparter2020-08-291-0/+19
| | | | | | | This patch adds the pcie-switch and bridge configuration for the Meraki MX60W. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-28 03:37:04 +0000