The Apple g++ check is really clang in disguise. Furthermore, testing on
Linux hosts reveals that clang can sufficiently replace gcc.
Minimum version of clang is 12 because of ccache.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17259
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add basic support for the TP-Link SG2008P V3 variant. The switch appears
to be identical to the V1 variant, except that it uses the MP3924
instead of the TPS23861 PoE chip.
Specifications:
---------------
* SoC: Realtek RTL8380M
* Flash: 32 MiB SPI flash (Vendor varies)
* RAM: 256 MiB (Vendor varies)
* Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports
* Buttons: 1x "Reset" button on front panel
* Power: 53.5V DC barrel jack
* UART: 1x serial header, unpopulated
* PoE: 1x MPS MP3924 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- Switch functions
- System LED
- Basic PoE support (no driver, but a startup script puts the chip
into AUTO mode)
Not yet enabled:
----------------
- PoE, Link/Act, PoE max and System LEDs
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Daniel Tang <tangrs@google.com>
Link: https://github.com/openwrt/openwrt/pull/20616
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When growing the segment array in find_entry(), the memset() that zeroes
the newly allocated slots computed the destination with redundant sizeof
scaling:
memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), ...)
segments is a typed pointer, so pointer arithmetic already scales by the
element size. Multiplying the offset by sizeof again advances the
destination by num_segments * sizeof^2 bytes, landing far outside the
realloc()'d buffer and zeroing unrelated heap memory whenever a TFFS
entry spans multiple segments that require array expansion.
Drop the redundant multiplication so the memset targets segments[num_segments].
This is a robustness fix for malformed/corrupt TFFS content; the parser
only reads the on-device nand-tffs MTD partition as root, so it is not
considered security relevant.
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23763
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Backport two upstream commits that replace memset() on coherent DMA
descriptor rings with explicit WRITE_ONCE() status word stores.
On 32-bit PowerPC platforms like apm821xx, coherent DMA memory may be
mapped uncached. The optimized memset() path can use dcbz there, which
triggers alignment warnings and spams the kernel log.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23776
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Move apm821xx to the 6.18 kernel after testing it as the testing kernel.
There are ethernet performance improvements in the 6.18 kernel for
whatever reason. There's also work on getting rid of dmesg slop at
runtime.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23777
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add a temperature/fan sensor (hwmon) driver for the Hasivo / Horaco
management MCU as a second child of the hasivo MCU MFD (alongside the
watchdog). It exposes the CPU and system temperatures and a 3-state fan
control (auto / force-on / force-off), read/written through the parent's
shared syscon regmap.
The register protocol was reverse-engineered from the stock 'imi' firmware
and verified on hardware. The fan-status register (0xFB) reflects the MCU's
effective drive state, not actual rotation (a blocked fan still reads
force-on), so no fanN_alarm is exposed. pwm1 echoes the commanded state so
a write reads back consistently, and falls back to the live drive state in
automatic mode. The register map is shared across boards.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/23762
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
The watchdog and the temperature/fan hwmon are the same management MCU at
a single I2C address (0x6f). Linux binds one driver per I2C client, so the
watchdog cannot keep owning the address directly if the hwmon is to live
on the same chip. Convert it from a standalone i2c_driver into a
platform_driver child of the hasivo MCU MFD that reaches the chip through
the parent's shared regmap (syscon), and depend on kmod-mfd-hasivo-stc8.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/23762
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Make use of scoped_guard macro to ease lock and error handling in
pcs_config by having a dedicated scope and no need for gotos.
While being here, replace -ENOTSUPP with preferred -EOPNOTSUPP and drop
{ } brackets for single statement block.
Link: https://github.com/openwrt/openwrt/pull/23759
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add the mandatory activate/deactivate bring-up hooks to rtpcs_sds_ops
and let rtpcs_pcs_config() drive the full sequence around the variant
configuration:
deactivate -> setup_serdes -> activate -> post_config
The per-variant calls that were open-coded at the start and end of the
setup_serdes() functions are removed in favour of these indirections.
RTL839X never powered the SerDes down/up, so it gets no-op stubs to
satisfy the contract for now. Execution order is preserved for all
variants.
Link: https://github.com/openwrt/openwrt/pull/23759
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Some variants need finalization that must run only after the SerDes is
powered up: RTL838X performs a one-shot switch queue reset on first
start, RTL930X runs RX calibration and the TX config. So far this lived
at the tail of the variant setup_serdes() functions.
Add an optional post_config hook to rtpcs_sds_ops and call it from
rtpcs_pcs_config() right after setup_serdes(), then relocate the
RTL838X and RTL930X tail work into it. As activate() still runs at the
end of setup_serdes() here, the execution order is unchanged.
Link: https://github.com/openwrt/openwrt/pull/23759
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
In RTL930x setup, tx config was called at then end of the procedure
after configuration and calibration ran. This is still a leftover from
the old code located in DSA/PHY. However, applying TX configuration like
amplification factors, etc. doesn't make sense after calibration, it
should run before. Moreover the call was commented with "leave loopback
mode" which is just wrong and doesn't describe what the function does.
Fix this misery.
Testing on device with different interface modes shows no difference so
far, especially no negative effects.
Link: https://github.com/openwrt/openwrt/pull/23759
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Currently the "WiFi" LED indicator light is triggered only by activity on the 5 GHz PHY.
Change it to be triggered by WLAN activity on either Wi-Fi PHY, matching stock behaviour, by using
`kmod-ledtrig-network` added in 2aa1185fb0 ('leds: add "network" LED trigger (lan/wan/wlan)').
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The second WLAN MAC address in the "Factory" partition at 0x0a is not the same as the
WLAN 5GHz BSSID observed when using the manufacturer's stock firmware, which is derived from
the 2.4GHz/label MAC address by setting bits 26 and 7 (Locally Administered).
While at it, also fix alphabetical ordering of some other device names.
Fixes: 1748ce8295 ("mediatek: add support for WAVLINK WL-WN536AX6 Rev a")
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Currently the WAN MAC address is read from the first (LAN) MAC address in the "HW" partition and
then incremented by 1 instead of being read directly from the second MAC address.
Change to reading the two MAC addresses (LAN/WAN) directly from "Factory" partition.
Fixes: 1748ce8295 ("mediatek: add support for WAVLINK WL-WN536AX6 Rev a")
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Enable nmbm bad block management with up to 8 MiB reserved. The manufacturer's stock device tree
contains the property `compatible = "generic,nmbm";` in node `nmbm_spim_nand` and
manufacturer's stock bootlog contains "nmbm nmbm_spim_nand: NMBM has been successfully attached"
Fixes: 1748ce8295 ("mediatek: add support for WAVLINK WL-WN536AX6 Rev a")
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The board contains a TI TMP75 temperature sensor located near the ethernet
PHYs, attached to the thermal mass of the back case, close to main SoC.
Configure `gsbi2` for i2c mode and include `kmod-hwmon-lm75` package.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Link: https://github.com/openwrt/openwrt/pull/23740
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
In previous versions of OpenWrt, ethernet was partially working,
sometimes depending on initialization state left by bootloader.
Since the switch to NSS drivers, it is completely broken.
- swap GMAC to PHY address mapping
- use rgmii internal delay
- drop `fixed-link` rates
- add pinctrl settings for rgmii0
- declare reset GPIO 51 (used for both PHYs)
- disable hibernation
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Link: https://github.com/openwrt/openwrt/pull/23740
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
OpenWrt has recently added the "network" LED trigger to support routers
that have a single WLAN LED for multiple phys.
This patch replaces the temporary workaround used during initial
support, where the LED was triggered only by activity on a single phy.
With this change, the WLAN LED on the ipTIME AX3000SE now correctly
indicates activity on both `phy0` and `phy1`.
Signed-off-by: Donghyun Ko <nyankosoftware@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23723
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Update to 2.5.3 and use the official tarball.
Changelog: https://github.com/ppp-project/ppp/releases/tag/v2.5.3
Removed upstreamed:
- 000-pppd-session-fixed-building-with-gcc-15.patch
- 001-pppdump-fixed-building-with-gcc-15.patch
- 501-fix-memcpy-fortify.patch
- 502-remove_mru.patch
Manually rebased:
- 500-add-pptp-plugin.patch
Add a pending patch to relax the check to avoid breaking existing
configurations.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23540
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Published sources archives may contain a mixture of MTIMEs, so taking the time
of the first file found varies based on filesystem order. To fix this, sort all
MTIMEs and take the latest.
Since piping into a file directly creates that file, we also need to
specifically tell `find` to ignore `version.date`.
Furthermore, move this prior to the ./src copy step, since for some packages,
the OpenWrt build system ships extra ./src files, which would introduce the
wrong timestamps again.
Fix: e36c2946b7 build: derive PKG_SOURCE_DATE_EPOCH from the unpacked source tree
Link: https://github.com/openwrt/openwrt/pull/23756
Signed-off-by: Paul Spooren <mail@aparcar.org>
The firmware-version gate in mxl862xx_phylink_get_caps() leaves
config->supported_interfaces empty for the CPU/SerDes ports (9, 13) when
the switch runs firmware older than 1.0.84. phylink rejects an empty
supported_interfaces bitmap, so the switch fails to probe at all:
mxl862xx mdio-bus:10: switch ready after 2480ms, firmware 1.0.70 (build 70)
mxl862xx mdio-bus:10: phylink: error: empty supported_interfaces
error creating PHYLINK: -22
mxl862xx mdio-bus:10: probe with driver mxl862xx failed with error -22
This regresses boards still shipping the older vendor firmware (e.g. the
BananaPi BPi-R4 Pro 8X, which ships 1.0.70) where all LAN ports disappear.
Ungate only the CPU/SerDes ports (9, 13) so the switch probes and the user
can update the firmware; ports 10..12 and 14..16 stay gated as they are
genuinely unsupported by the old firmware.
Tested on a BPi-R4 Pro 8X with switch firmware 1.0.70 (kernel 6.18); the
6.12 patch receives the identical change for parity.
Fixes: 028dc3f57a ("generic: 6.18: update MxL862xx DSA switch driver")
Fixes: 5b69e6a4a6 ("generic: 6.12: update MxL862xx DSA switch driver")
Signed-off-by: Aliaksandr Babrykovich <abobrikovich@gmail.com>
[refreshed patches]
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The u-boot build for mediatek ARM SoCs doesn't require pylibfdt. We
can use pre-build kernel DTC to save some build time.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Ryan Leung
Rosen Penev
Daniel Tang
Hauke Mehrtens
David Bauer
Carlo Szelinsky
Jonas Jelonek
Qingfang Deng
Seo Suchan
Sebastian Schaper
Donghyun Ko
Shiji Yang
Josef Schlehofer
Markus Stockhausen
John Audia
Paul Spooren
Aliaksandr Babrykovich