Merge pull request #6 from coolsnowwolf/master

#2

config/Config-build.in

@@ -191,11 +191,10 @@ menu "Global build settings"
 		  this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package
 		  Makefile.
 
-	config PKG_ASLR_PIE
-		bool
+	choice
 		prompt "User space ASLR PIE compilation"
-		select BUSYBOX_DEFAULT_PIE
-		default n
+		default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK)
+		default PKG_ASLR_PIE_REGULAR
 		help
 		  Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.
 		  This enables package build as Position Independent Executables (PIE)
@@ -206,6 +205,21 @@ menu "Global build settings"
 		  to predict when an attacker is attempting a memory-corruption exploit.
 		  You can disable this per package by adding PKG_ASLR_PIE:=0 in the package
 		  Makefile.
+		  Be ware that ASLR increases the binary size.
+		config PKG_ASLR_PIE_NONE
+			bool "None"
+			help
+			  PIE is deactivated for all applications
+		config PKG_ASLR_PIE_REGULAR
+			bool "Regular"
+			help
+			  PIE is activated for some binaries, mostly network exposed applications
+		config PKG_ASLR_PIE_ALL
+			bool "All"
+			select BUSYBOX_DEFAULT_PIE
+			help
+			  PIE is activated for all applications
+	endchoice
 
 	choice
 		prompt "User space Stack-Smashing Protection"

config/Config-images.in

@@ -297,6 +297,7 @@ menu "Target Images"
 		int "Kernel partition size (in MB)"
 		depends on GRUB_IMAGES || EFI_IMAGES || USES_BOOT_PART
 		default 8 if TARGET_apm821xx_sata
+		default 64 if TARGET_brcm2708
 		default 16
 
 	config TARGET_ROOTFS_PARTSIZE

include/hardening.mk

@@ -7,6 +7,7 @@
 
 PKG_CHECK_FORMAT_SECURITY ?= 1
 PKG_ASLR_PIE ?= 1
+PKG_ASLR_PIE_REGULAR ?= 0
 PKG_SSP ?= 1
 PKG_FORTIFY_SOURCE ?= 1
 PKG_RELRO ?= 1
@@ -16,12 +17,18 @@ ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
     TARGET_CFLAGS += -Wformat -Werror=format-security
   endif
 endif
-ifdef CONFIG_PKG_ASLR_PIE
+ifdef CONFIG_PKG_ASLR_PIE_ALL
   ifeq ($(strip $(PKG_ASLR_PIE)),1)
     TARGET_CFLAGS += $(FPIC)
     TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
   endif
 endif
+ifdef CONFIG_PKG_ASLR_PIE_REGULAR
+  ifeq ($(strip $(PKG_ASLR_PIE_REGULAR)),1)
+    TARGET_CFLAGS += $(FPIC)
+    TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs
+  endif
+endif
 ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR
   ifeq ($(strip $(PKG_SSP)),1)
     TARGET_CFLAGS += -fstack-protector

include/kernel-version.mk

@@ -6,13 +6,13 @@ ifdef CONFIG_TESTING_KERNEL
   KERNEL_PATCHVER:=$(KERNEL_TESTING_PATCHVER)
 endif
 
-LINUX_VERSION-4.9 = .207
-LINUX_VERSION-4.14 = .160
-LINUX_VERSION-4.19 = .91
+LINUX_VERSION-4.9 = .208
+LINUX_VERSION-4.14 = .167
+LINUX_VERSION-4.19 = .98
 
-LINUX_KERNEL_HASH-4.9.207 = ca86637e7b5bec65eeb7da695824e0e8aca5ba52eb742885f0b7241977400124
-LINUX_KERNEL_HASH-4.14.160 = c60326bad1bcdede514ca8a0bb96843fa7578ef00829cced6218b888b2efa92c
-LINUX_KERNEL_HASH-4.19.91 = f403c3dee12ded0af1889c78871abf7a531a978ba423f1ca772de702a92c3447
+LINUX_KERNEL_HASH-4.9.208 = b7ad1c9841d671d026c55a4c91c77205f8b488ca5f980f838591c68662e0525a
+LINUX_KERNEL_HASH-4.14.167 = 2bb78fc7a902faf4f5dad47fdbc2f4bf3df3cf9b41f408e7260f36656659fe43
+LINUX_KERNEL_HASH-4.19.98 = 91feb13bc22d60d69596ab1d01dfecbec13ef70f00c89a483e0733af94dd2937
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))

include/target.mk

@@ -13,14 +13,15 @@ __target_inc=1
 DEVICE_TYPE?=router
 
 # Default packages - the really basic set
-DEFAULT_PACKAGES:=base-files libc libgcc busybox dropbear mtd uci opkg netifd fstools uclient-fetch logd block-mount coremark \
-kmod-nf-nathelper kmod-nf-nathelper-extra kmod-ipt-raw wget \
+DEFAULT_PACKAGES:=base-files libc libgcc busybox dropbear mtd uci opkg netifd fstools uclient-fetch logd \
+block-mount coremark kmod-nf-nathelper kmod-nf-nathelper-extra kmod-ipt-raw wget \
 default-settings luci luci-app-ddns luci-app-sqm luci-app-upnp luci-app-adbyby-plus luci-app-autoreboot \
 luci-app-filetransfer luci-app-vsftpd luci-app-ssr-plus \
 luci-app-pptp-server luci-app-arpbind luci-app-vlmcsd luci-app-wol luci-app-ramfree \
-luci-app-sfe luci-app-flowoffload luci-app-nlbwmon luci-app-accesscontrol
+luci-app-sfe luci-app-flowoffload luci-app-nlbwmon luci-app-accesscontrol \
+ddns-scripts_aliyun ddns-scripts_dnspod libustream-openssl
 # For nas targets
-DEFAULT_PACKAGES.nas:=fdisk lsblk mdadm automount autosamba luci-app-usb-printer 
+DEFAULT_PACKAGES.nas:=fdisk lsblk mdadm automount autosamba luci-app-usb-printer
 # For router targets
 DEFAULT_PACKAGES.router:=dnsmasq-full iptables ppp ppp-mod-pppoe firewall kmod-ipt-offload kmod-tcp-bbr
 DEFAULT_PACKAGES.bootloader:=
@@ -56,7 +57,7 @@ else
   endif
 endif
 
-ifneq ($(filter 3.18 4.9,$(KERNEL_PATCHVER)),)
+ifneq ($(filter 4.9,$(KERNEL_PATCHVER)),)
   DEFAULT_PACKAGES.router:=$(filter-out kmod-ipt-offload,$(DEFAULT_PACKAGES.router))
 endif
 

package/boot/kexec-tools/Makefile

@@ -44,7 +44,7 @@ define Package/kexec
   $(call Package/kexec-tools/Default)
   TITLE:=Kernel boots kernel
   DEPENDS:=\
-	@armeb||@arm||@i386||@x86_64||@powerpc64||@mipsel||@mips \
+	@(armeb||arm||i386||x86_64||powerpc64||mipsel||mips) \
 	+KEXEC_ZLIB:zlib +KEXEC_LZMA:liblzma @KERNEL_KEXEC
 endef
 
@@ -55,7 +55,7 @@ endef
 define Package/kdump
   $(call Package/kexec-tools/Default)
   TITLE:=Kernel crash analysis
-  DEPENDS:=+kexec @i386||@x86_64||@arm @KERNEL_CRASH_DUMP
+  DEPENDS:=+kexec @(i386||x86_64||arm) @KERNEL_CRASH_DUMP
 endef
 
 define Package/kdump/description

package/boot/uboot-tegra/Makefile

@@ -0,0 +1,64 @@
+#
+# Copyright (C) 2017-2019 Tomasz Maciej Nowak <tomek_n@o2.pl>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION := 2019.04
+PKG_RELEASE := 1
+
+PKG_HASH := 76b7772d156b3ddd7644c8a1736081e55b78828537ff714065d21dbade229bef
+
+PKG_MAINTAINER := Tomasz Maciej Nowak <tomek_n@o2.pl>
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+
+define U-Boot/Default
+  BUILD_TARGET := tegra
+  HIDDEN := y
+endef
+
+define U-Boot/trimslice
+  NAME := CompuLab TrimSlice
+  BUILD_DEVICES := compulab_trimslice
+  UBOOT_IMAGE := trimslice-mmc.img trimslice-spi.img
+  SOC := tegra20
+  VENDOR := compulab
+endef
+
+UBOOT_TARGETS := trimslice
+
+define Build/bct-image
+	$(CP) $(PKG_BUILD_DIR)/u-boot-dtb-tegra.bin $(PKG_BUILD_DIR)/u-boot.bin
+	$(foreach bct,$(basename $(UBOOT_IMAGE)), \
+		cd $(PKG_BUILD_DIR); \
+		cbootimage -s $(SOC) -gbct \
+			$(STAGING_DIR_HOST)/share/cbootimage-configs/$(SOC)/$(VENDOR)/$(VARIANT)/$(bct).bct.cfg \
+			$(bct).bct; \
+		cbootimage -s $(SOC) \
+			$(STAGING_DIR_HOST)/share/cbootimage-configs/$(SOC)/$(VENDOR)/$(VARIANT)/$(bct).img.cfg \
+			$(PKG_BUILD_DIR)/$(bct).img; \
+		rm -f $(bct).bct; \
+	)
+endef
+
+define Build/Configure
+	sed '/select BINMAN/d' -i $(PKG_BUILD_DIR)/arch/arm/mach-tegra/Kconfig
+	$(call Build/Configure/U-Boot)
+endef
+
+define Build/Compile
+	$(call Build/Compile/U-Boot)
+	$(call Build/bct-image)
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(foreach img,$(UBOOT_IMAGE), \
+		$(CP) $(PKG_BUILD_DIR)/$(img) $(STAGING_DIR_IMAGE)/;)
+endef
+
+$(eval $(call BuildPackage/U-Boot))

package/devel/perf/Makefile

@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=perf
 PKG_VERSION:=$(LINUX_VERSION)
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_USE_MIPS16:=0
 PKG_BUILD_PARALLEL:=1
@@ -26,7 +26,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/perf
   SECTION:=devel
   CATEGORY:=Development
-  DEPENDS:= +libelf1 +libdw +(mips||mipsel||powerpc||i386||x86_64||arm||aarch64):libunwind +libpthread +librt +objdump @!LINUX_3_18 @!IN_SDK @!TARGET_arc770 @KERNEL_PERF_EVENTS
+  DEPENDS:= +libelf +libdw +PACKAGE_libunwind:libunwind +libpthread +librt +objdump @!IN_SDK @!TARGET_arc770 @KERNEL_PERF_EVENTS
   TITLE:=Linux performance monitoring tool
   VERSION:=$(LINUX_VERSION)-$(PKG_RELEASE)
   URL:=http://www.kernel.org
@@ -36,10 +36,6 @@ define Package/perf/description
   perf is the Linux performance monitoring tool
 endef
 
-define Build/Prepare
-	$(CP) $(LINUX_DIR)/tools/perf/* $(PKG_BUILD_DIR)/
-endef
-
 MAKE_FLAGS = \
 	ARCH="$(LINUX_KARCH)" \
 	NO_LIBPERL=1 \
@@ -59,13 +55,13 @@ MAKE_FLAGS = \
 	LDFLAGS="$(TARGET_LDFLAGS)" \
 	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='') \
 	WERROR=0 \
+	O=$(PKG_BUILD_DIR) \
 	prefix=/usr
 
 define Build/Compile
 	+$(MAKE_FLAGS) $(MAKE) $(PKG_JOBS) \
-		-C $(PKG_BUILD_DIR) \
-		-f Makefile.perf \
-		--no-print-directory
+		--no-print-directory \
+		-C $(LINUX_DIR)/tools/perf
 endef
 
 define Package/perf/install