Commit Graph

323 Commits

Author SHA1 Message Date
Kevin Darbyshire-Bryant
1d2590f838 kernel: bump 4.9 to 4.9.75
Refresh patches

Fixes:  CVE-2017-5754 aka Meltdown

Tested-on: ar71xx Archer C7 v2

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
[fix conflict after 4.14 bump]
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2018-01-10 00:11:39 +02:00
Mathias Kresin
f0227af5d6 ipq806x: drop kernel 4.4 leftovers
Remove the kernel 4.4 specific devicetree source files.

Fixes: 3a3564ead5 ("ipq806x: remove v4.4 support")

Signed-off-by: Mathias Kresin <dev@kresin.me>
2018-01-09 22:06:37 +01:00
Christian Lamparter
da6fdce365 base-files: unify get_dt_led helper function
Lantiq and IPQ806X (which includes IPQ40XX) both define the
same custom function {ipq806x|lantiq}_get_dt_led.

This patch moves the function into the base-file package at
lib/functions/leds.sh to make it more accessible for other
targets as well.

Cc: Mathias Kresin <dev@kresin.me>
Cc: John Crispin <john@phrozen.org>
Cc: Hannu Nyman <hannu.nyman@iki.fi>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2017-12-14 09:29:30 +01:00
Luis Araneda
575178e462 treewide: add only one device when appending to TARGET_DEVICES
This will avoid some conflicts when doing a git rebase or merge,
specially when adding support to a new device.

Signed-off-by: Luis Araneda <luaraneda@gmail.com>
[drop brcm47xx changes which rename the images]
Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-12-12 18:47:26 +01:00
Stijn Tintel
f997478655 kernel: bump 4.9 to 4.9.67
Refresh patches.
Remove upstreamed patches:
- generic/190-1-5-e1000e-Fix-error-path-in-link-detection.patch
- generic/190-3-5-e1000e-Fix-return-value-test.patch
- generic/190-4-5-e1000e-Separate-signaling-for-link-check-link-up.patch
- generic/190-5-5-e1000e-Avoid-receiver-overrun-interrupt-bursts.patch
- ramips/0102-MIPS-ralink-Fix-MT7628-pinmux.patch
- ramips/0103-MIPS-ralink-Fix-typo-in-mt7628-pinmux-function
Update patches that no longer apply:
- layerscape/815-spi-support-layerscape.patch
- ramips/0099-pci-mt7620.patch

Compile-tested on ar71xx, brcm2708/bcm2708, octeon and x86/64.
Runtime-tested on ar71xx, brcm2708/bcm2708, octeon and x86/64.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2017-12-07 01:41:09 +02:00
Koen Vandeputte
62ede4f783 kernel: bump 4.9 to 4.9.63
Refreshed all patches.

Removed upstreamed parts.

Compile-tested: cns3xxx, imx6, mvebu, layerscape
Run-tested: cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
2017-11-22 20:45:52 +01:00
Roman Yeryomin
8bb33f3c98 ipq806x: ipq4019: enable usb phy
Run tested on ap-dk01.2-c1

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-11-17 08:18:00 +01:00
Stefan Lippers-Hollmann
9a221c6d69 ip806x: nbg6817: sysupgrade support both targets for kernel/ rootfs partitions
With this commit and the previous "nbg6817: don't hardcode the rootfs location
by using append-rootblock instead" applied, it is possible to boot- and
sysupgrade from both dual-boot sets (the primary mmcblk0p4+mmcblk0p5 or the
alternative mmcblk0p7+mmcblk0p8). However the sysupgrade support does not
toggle between both dual-boot sets between firmware upgrades so far.

The partition map of the eMMC used in the nbg6817 is:

Found valid GPT with protective MBR; using GPT.
Disk /dev/mmcblk0: 7471104 sectors, 3.6 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): XXX
Partition table holds up to 12 entries
First usable sector is 34, last usable sector is 7471070
Partitions will be aligned on 2-sector boundaries
Total free space is 1 sectors (512 bytes)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              34            8225   4.0 MiB     FFFF  rootfs_data
   2            8226           16417   4.0 MiB     FFFF  romd
   3           16418           18465   1024.0 KiB  FFFF  header
   4           18466           26657   4.0 MiB     FFFF  kernel
   5           26658          157729   64.0 MiB    FFFF  rootfs
   6          157730          159777   1024.0 KiB  FFFF  header_1
   7          159778          167969   4.0 MiB     FFFF  kernel_1
   8          167970          299041   64.0 MiB    FFFF  rootfs_1
   9          299042          823329   256.0 MiB   FFFF  bu1
  10          823330         7471069   3.2 GiB     FFFF  bu2

rootfs_data is the ext4 formatted overlay of the OEM firmware, LEDE
ignores it due to its (too) small size.

romd/ bu1 are initialized with zeroes (0x00) and unused.

bu2 is formatted with ext4 and used for streamboost and other optional
functionality by the OEM firmware, it is reformatted during factory
resets of the OEM firmware.

header/ header_1 contains version information for the corresponding
vendor firmwares installed to kernel/rootfs or kernel_1/ rootfs_1, the
format hasn't been completely reverse engineered so far and remains
left untouched by LEDE:

V1.00(ABCS.2)C0:
 00000000  00 00 a7 74 01 32 f0 00  56 31 2e 30 30 28 41 42  |...t.2..V1.00(AB|
 00000010  43 53 2e 32 29 43 30 00  ff ff ff ff ff ff ff ff  |CS.2)C0.........|
 00000020  ff ff ff ff ff ff ff ff  00 00 d5 dc 4e 42 47 36  |............NBG6|
 00000030  38 31 37 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |817.............|
 00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00000060  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 22 a3  |..............".|
 00000070  00 1c 70 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..p.............|
 00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00000800  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 *
 00100000

V1.00(ABCS.5)C0:
 00000000  00 00 bf 94 01 46 d8 00  56 31 2e 30 30 28 41 42  |.....F..V1.00(AB|
 00000010  43 53 2e 35 29 43 30 00  ff ff ff ff ff ff ff ff  |CS.5)C0.........|
 00000020  ff ff ff ff ff ff ff ff  00 00 d6 5a 4e 42 47 36  |...........ZNBG6|
 00000030  38 31 37 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |817.............|
 00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00000060  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 c0 2c  |...............,|
 00000070  00 1c 58 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..X.............|
 00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
 *
 00010000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 *
 00100000

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2017-10-29 03:11:51 +01:00
Stefan Lippers-Hollmann
b583aaf5aa ip806x: nbg6817: don't hardcode the rootfs location by using append-rootblock instead
This changes the cmdline from:

Kernel command line: root=/dev/mmcblk0p5 rootfstype=squashfs,ext4 rootwait noinitrd
Bootloader command line (ignored): board=NBG6817 root=/dev/mmcblk0p5 rootwait zld_ver=2.04 console=ttyHSL1,115200n8 mtdparts=m25p80:0xC0000(SBL)ro,0x40000(TZ)ro,0x40000(RPM)ro,0x80000(u-boot)ro,0x10000(env)ro,0x10000(ART)ro,0x10000(dualflag),0x210000(reserved)

to

Kernel command line: rootfstype=squashfs,ext4 rootwait noinitrd root=/dev/mmcblk0p5
Bootloader command line (ignored): board=NBG6817 root=/dev/mmcblk0p5 rootwait zld_ver=2.04 console=ttyHSL1,115200n8 mtdparts=m25p80:0xC0000(SBL)ro,0x40000(TZ)ro,0x40000(RPM)ro,0x80000(u-boot)ro,0x10000(env)ro,0x10000(ART)ro,0x10000(dualflag),0x210000(reserved)

As a consequence booting from the alternative dual-boot partition set
(root=/dev/mmcblk0p8) becomes possible.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2017-10-29 02:55:27 +01:00
Roman Yeryomin
156f2df879 ipq806x: ipq4019: add ap-dk01.1-c1 board support
AP-DK01.1-C1 is QCA dev board with:
- ipq4018 quad core ARM @716.8MHz, 2x2 dual (11n+11ac) radio
- 256MB RAM
- 32MB SPI flash
- QCA8075 multiport ethernet phy (WAN port, 4x LAN ports)

First installation via u-boot:
sf probe
sf erase 0x180000 0x1a00000
tftpboot 0x84000000 lede-ipq806x-AP-DK01.1-C1-squashfs-sysupgrade.bin
sf write 0x84000000 0x180000 $filesize

Further upgrades via sysupgrade.

Changes:
- add partitions
- set memory size to 256MB
- add reserved memory mapping
- add correct compatible string
- add image generation
- extract pre-cal data from ART partition

Compile and run tested.
Wirespeed NAT can be achieved with spreading rx interrupts over different
cores. Wifi speed is ~550Mbps @5GHz in open air.

Note:
AP-DK01.1-C1 is fully compatible with AP-DK01.2-C1, which has
ipq4028 instead of ipq4018 on board.

Changes since v2:
- based on dts(i) rework/cleanup submitted:
  http://lists.infradead.org/pipermail/lede-dev/2017-October/009596.html
- precise reserved memory mapping
- more precise description
- compatible string

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:24:26 +02:00
Roman Yeryomin
a22e2bd37d ipq806x: ipq4019: dts: fix maximum cpu speed
Supported frequencies of all ipq40xx chips are 48, 200, 500 and 716.8 MHz.
Previous 666MHz setting was most likely related to instability of early
chips/boards made before mass production.

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:19:32 +02:00
Roman Yeryomin
21802ce3ab ipq806x: ipq4019: dts: remove spi chip node from ap-dk01 dtsi
All ap-dk01 boards have different spi chips, thus no point in keeping it in dtsi.

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:19:19 +02:00
Roman Yeryomin
97a836318f ipq806x: ipq4019: dts: move ap-dk01 networking entries to dtsi
That is mdio/ethernet and wifi are present on all ap-dk01 boards.

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:19:02 +02:00
Roman Yeryomin
45b1042a0a ipq806x: ipq4019: dts: remove counter entry from ap-dk01 boards
There is no code implementing "qcom,qca-gcnt", so no point in keeping it.

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:18:51 +02:00
Roman Yeryomin
91f0345801 ipq806x: ipq4019: dts: move ap-dk01 tcsr nodes to dtsi
tcsr configuration is the same for all ap-dk01 boards

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:18:38 +02:00
Roman Yeryomin
ba9aa76a3a ipq806x: ipq4019: dts: remove crypto nodes from board dts
crypto and cryptobam are already present in dtsi used by these boards:
- fritz4040
- nbg6617
- rt-ac58u

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:18:24 +02:00
Roman Yeryomin
1abc788924 ipq806x: ipq4019: dts: move xo and timer nodes to SoC dtsi
xo and timer are common thing and it makes more sense to keep them in SoC dtsi

Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:18:11 +02:00
Roman Yeryomin
ab3ab6241f ipq806x: ipq4019: dts: fix pinctrl node name
Signed-off-by: Roman Yeryomin <roman@advem.lv>
2017-10-30 01:17:58 +02:00
Stefan Lippers-Hollmann
189433e543 ipq806x: nbg6817: sync MAC addresses to the upstream values
The ZyXEL NBG6817 calculates all MAC addresses based on the ethaddr
value stored in the U-Boot environment (0:APPSBLENV). No MAC addresses
are stored in the ART partition and the generated MAC addresses for the
wlan interfaces alternate randomly between 12:34:56:78:90:12 and
00:03:7f:12:34:56.

interface	  new/ OEM MAC	old MAC

wlan-2.4g (phy1): ethaddr	undefined
wlan-5g   (phy0): ethaddr + 1	undefined
lan             : ethaddr + 2	ethaddr
wan             : ethaddr + 3	ethaddr + 1

This patch defines stable MAC addresses for the wlan interfaces for
the first time instead of generating them at random. The previously
defined values for lan/ wan are changed to follow the settings of the
OEM firmware.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2017-11-03 20:04:51 +01:00
Stefan Lippers-Hollmann
6e6d4f2e87 ipq806x: nbg6817: add kmod-fs-ext4 to device packages
The ZyXEL NBG6817 uses an eMMC flash for the rootfs, which is split
into the readonly squashfs and ext4 for the overlay. This adds the
required package to the device packages to allow mounting the overlay
by default.

/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/loop0 on /overlay type ext4 (rw,noatime,data=ordered)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
mountd(pid1040) on /tmp/run/blockd type autofs (rw,relatime,fd=7,pgrp=1,timeout=30,minproto=5,maxproto=5,indirect)

Before this commit, the ext4 based overlayfs could not be mounted,
which left only the tmpfs based/ volatile  emergency overlay in place.

Fixes: https://forum.lede-project.org/t/zyxel-nbg6817-flashing-from-oem/768

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2017-11-03 20:04:51 +01:00
Jonas Gorski
6f528dfbd9 treewide: do not use IMG_PREFIX in Image/Prepare
IMG_PREFIX can be modified in ImageBuilder by passing EXTRA_IMAGE_NAME
on command line, but Image/Prepare is not run in ImageBuilder. This
causes missing files when IMG_PREFIX is used for target file names in
Image/Prepare, then as source file names in Image/BuildKernel or
Image/Build.

Fix this by using a fixed output file name in Image/Prepare, and copy to
the expected file name in Image/BuildKernel instead, which is run by
ImageBuilder.

Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
2017-10-26 12:26:25 +02:00
Tolga Cakir
f4d4a3c0ef ipq806x: fix Zyxel NBG6817 WiFi button
Zyxel NBG6817 features a WiFi button, which becomes functional by setting
correct GPIO. It is a switch-type button, so it emits KEY_RFKILL on each ON
and OFF state. This is achieved by setting input-type to EV_SW.

Signed-off-by: Tolga Cakir <tolga@cevel.net>
2017-10-25 09:22:14 +02:00
Stijn Tintel
834810617e kernel: bump 4.9 to 4.9.58
Refresh patches.
Compile-tested: ar71xx, octeon, x86/64.
Runtime-tested: octeon, x86/64.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2017-10-23 17:23:34 +03:00
Stijn Tintel
e37c7636ee kernel: update 4.9 to 4.9.50
Refresh patches.
Compile-tested on ipq8065/nbg6817 and x86/64.
Runtime-tested on ipq8065/nbg6817 and x86/64.

Fixes CVE-2017-1000251.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
[adapt qcom_nandc.c patches to match upstream changes, test ipq8065/nbg6817]
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2017-09-18 04:35:57 +03:00
Baptiste Jonglez
5889f92f7d ipq806x: Archer C2600: fix switch ports numbering
The order of LAN ports shown in Luci is reversed compared to what is
written on the case of the device.  Fix the order so that they match.

Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
2017-08-24 08:39:12 +02:00
Stijn Tintel
2d02a4f5bd kernel: update 4.9 to 4.9.44
Refresh patches.
Adapt 704-phy-no-genphy-soft-reset.patch.
Remove brcm2708/950-0005-mm-Remove-the-PFN-busy-warning.patch.
Compile-tested on brcm2708/bcm2708 and x86/64.
Runtime-tested on brcm2708/bcm2708 and x86/64.

Fixes the following vulnerabilities:
- CVE-2017-7533
- CVE-2017-1000111
- CVE-2017-1000112

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2017-08-17 12:34:34 +02:00
Mathias Kresin
e4e984f2a0 treewide: use only board_name function to get name
Do not parse /tmp/sysinfo/board_name, /proc/cpuinfo or the device tree
compatible string directly. Always use the board_name function to get
the board name.

The admswconfig package still reads /proc/cpuinfo directly. The code
looks somehow broken and the whole adm5120 which uses this package
looks unmaintained. Leave it as it is for now.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
Mathias Kresin
e0b9ec8e96 treewide: drop target board_name functions
They are not used any longer.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
Mathias Kresin
f12a32630f treewide: use the generic board_name function
Use the generic function instead ot the target specific ones.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
Mathias Kresin
ac3e05c5d7 treewide: populate boardname and model earlier
For targets using the generic board detection and board specific
settings in diag.sh, the board name is still unset at the time the
set_state() provided by diag.sh is called by 10_indicate_preinit.

Change the execution order to ensure the boardname is populated before
required the first time. Do the target specific board detection as
early as possible, directly followed by the generic one to allow a
seamless switch to the generic function for populating /tmp/sysinfo/.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
Koen Vandeputte
cd54b2d42b kernel: update kernel 4.9 to 4.9.37
- Refreshed all patches
- Removed upstreamed
- Adapted 4 patches:

473-fix-marvell-phy-initialization-issues.patch
-----------------------------------------------
Removed hunk 5 which got upstreamed

403-net-phy-avoid-setting-unsupported-EEE-advertisments.patch
404-net-phy-restart-phy-autonegotiation-after-EEE-advert.patch
--------------------------------------------------------------
Adapted these 2 RFC patches, merging the delta's from an upstream commit
(see below) which made it before these 2.

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-
stable.git/commit/?h=v4.9.36&id=97ace183074d306942b903a148aebd5d061758f0

180-usb-xhci-add-support-for-performing-fake-doorbell.patch
-----------------------------------------------------------
- Moved fake_doorbell bitmask due to new item

Compile tested on: cns3xxx, imx6
Run tested on: cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
2017-07-15 00:13:05 +02:00
Matthias Schiffer
438dcbfe74
base-files: automatically handle paths and symlinks for RAMFS_COPY_BIN
Depending on busybox applet selection, paths of basic utiilties may differ,
and may not work as symlinks to busybox. Simply using whatever binary is
found in PATH and detecting symlinks automatically is more robust and
easier to maintain.

The list of binaries is also slightly cleaned up and duplicates are
removed.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2017-07-11 17:26:32 +02:00
Matthias Schiffer
08a94ecaee
ipq806x: upgrade: fix RAMFS_COPY_*
RAMFS_COPY_* are moved to platform.sh toplevel. The unneeded
linksys_preupgrade function is removed, and the nand_do_upgrade call is
moved to platform_do_upgrade.

Fixes: 30f61a34b4 "base-files: always use staged sysupgrade"
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2017-07-11 17:19:23 +02:00
Ram Chandra Jangir
c2a4f144d7 ipq806x: Enable AP148 fit image(.itb) generation
This change enables .itb image generation for AP148,
It will help us to boot and test AP148 with NOR flash.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-07-06 07:16:40 +02:00
Piotr Dymacz
7d6c63d875 build: rename TPLINK_BOARD_NAME to TPLINK_BOARD_ID
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-29 10:37:36 +02:00
Stijn Tintel
880f73c327 kernel: cleanup CONFIG_SCHED_HRTICK
Remove CONFIG_SCHED_HRTICK from target configs, as it was added to the
generic config in b47fd76563.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2017-06-29 04:46:59 +02:00
Koen Vandeputte
69649a1b45 kernel: update kernel 4.9 to 4.9.34
- Refreshed all patches
- Adapted 1 (0031-mtd-add-SMEM-parser-for-QCOM-platforms.patch)

Compile tested on: brcm2708, cns3xxx, imx6
Run tested on: brcm2708, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
[Compile and run tested on brcm2708]
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2017-06-27 07:21:03 +02:00
Pavel Kubelun
189239ade3 ipq806x: qca99xx: fix wifi calibration
As of now OTP is being correctly parsed and the driver requires to parse pre-caldata to follow corresponding routine.

Rename cal file into pre-calfile so the board initialized correctly with API 2 board data (board-2.bin).

Also remove the now unneeded for qca9984 board.bin symlink to 5GHz calfile.

Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
2017-06-17 11:51:41 +02:00
Jo-Philipp Wich
55623a9c83 kernel: update kernel 4.9 to 4.9.31
Fixes the following security vulnerabilities:

CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the
Linux kernel through 4.10.15 allows attackers to cause a denial of service
(double free) or possibly have unspecified other impact by leveraging use
of the accept system call.

CVE-2017-9074
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service (out-of-bounds
read and BUG) or possibly have unspecified other impact via crafted socket
and send system calls.

CVE-2017-9075
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.

CVE-2017-9076
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux
kernel through 4.11.1 mishandles inheritance, which allows local users to
cause a denial of service or possibly have unspecified other impact via
crafted system calls, a related issue to CVE-2017-8890.

CVE-2017-9077
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel
through 4.11.1 mishandles inheritance, which allows local users to cause a
denial of service or possibly have unspecified other impact via crafted
system calls, a related issue to CVE-2017-8890.

CVE-2017-9242
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel
through 4.11.3 is too late in checking whether an overwrite of an skb data
structure may occur, which allows local users to cause a denial of service
(system crash) via crafted system calls.

Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8890
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9074
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9075
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9076
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9077
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9242
Ref: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.31

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2017-06-08 01:03:39 +02:00
Sergey Ryazanov
68e7a2a0b7 kernel: disable CONFIG_SG_POOL by default
CONFIG_SG_POOL symbol is selected only by CONFIG_SCSI, since the last
one is disabled by default then disable CONFIG_SG_POOL by default too.
And explicitly enable it only for platforms that use CONFIG_SCSI.

Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
2017-06-07 18:31:10 +02:00
Ram Chandra Jangir
e178d51a04 ipq806x: Enable ubi image for ipq40xx AP-DK04.1-C1 board
This change add IPQ40xx AP-DK04.1-C1 board image support,
enables ubi image for IPQ40xx AP-DK04.1-C1 board and also
add sysupgrage support for AP-DK04.1-C1 and generates a
sysupgrade.tar image.

Testing:
 *Tested on IPQ40xx AP-DK04.1-C1:
   a. NAND boot
   b. ubi sysupgrade

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-06-07 06:33:33 +02:00
Ram Chandra Jangir
5e1cc0c090 ipq806x: Updated various ipq40xx pin definitions
This change populates default values for various GPIO functions
in ipq40xx pinctrl driver.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-06-07 06:33:33 +02:00
Ram Chandra Jangir
7bf74d3185 ipq806x: add qpic nand and bam dma node's in ipq4019 dts tree
This change adds QPIC BAM dma and NAND driver node's in IPQ4019
device tree, also enable this for AP-DK04.1 based boards.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-05-29 07:26:03 +02:00
Ram Chandra Jangir
35307c0bbf ipq806x: Add support for custom data mapping in bam_dma dmaengine
This change adds a new function to support for preparing DMA descriptor
for custom data.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-05-29 07:25:59 +02:00
Ram Chandra Jangir
ea9e0cf2ce ipq806x: Added bam transaction and support additional CSRs
This change adds support for below:
- Bam transaction which will be used for any NAND request.
- Reset function for NAND BAM transaction
- Add support for additional CSRs.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-05-29 07:25:54 +02:00
Ram Chandra Jangir
2048cab22b ipq806x: Add bam_dma support in qcom_nand driver
The existing qcom_nand driver supports ADM DMA which is mainly
required for ipq806x family based boards,
IPQ40xx based boards uses BAM DMA in NAND driver, so this patch
adds BAM DMA support with compatible string as qcom,ebi2-nandc-bam.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-05-29 07:25:46 +02:00
Ram Chandra Jangir
d227bb06df ipq806x: Add support to configure ipq40xx GPIO_PULL bits
GPIO_PULL bits configurations in TLMM_GPIO_CFG register
differs for IPQ40xx from rest of the other qcom SoC's.
This change add support to configure the msm_gpio_pull
bits for ipq40xx, It is required to fix the proper
configurations of gpio-pull bits for nand pins mux.

Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
2017-05-29 07:25:39 +02:00
Hauke Mehrtens
0b17375931 kernel: update kernel 4.9 to 4.9.30
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2017-05-27 00:48:37 +02:00
Mathias Kresin
822ee54544 treewide: fix device tree path in scripts
The device tree is at /proc/device-tree/ without a base subdir.

Fixes: da472e5b30 ("treewide: access device tree from userspace via /proc/")

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-05-26 15:18:30 +02:00
Mathias Kresin
da472e5b30 treewide: access device tree from userspace via /proc/
Access the device tree via /proc/device-tree/ is the documented way to
access the properties. Everything else might not work in future.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-05-26 08:04:15 +02:00