Divested-WRT: No-nonsense hardened builds for Linksys WRT series

@solidus1983
I think CONFIG_ALL_KMODS=y does that.
Haven't tried it.
Afterwards you can upload
openwrt/bin/packages
to your webserver.
I'm not sure what you need to edit to add it as the default repo.

Thanks for the reply, I already changed the repo link to my ddns nameserver which links to my Webserver.

Will make that change and see how it goes thanks bud.

First of all THANK YOU a lot!

Stupid question, how do i migrate vom swconfig to DSA the cleanest way? I do not need to migrate any settings beside static ips... Just a clean installation with squashfs-factory.img, right?

I am willing to do some testing for stability with my WRT32X. THANKS again.

simply make changes to the network file in /etc/config folder.

Simply changing option ifname to

option ifname 'lan1 lan2 lan3 lan4'

That is all that is needed, if your static IP address are in DHCP then they will work without changes.

As for your other question about clean installation, you still use the openwrt-mvebu-cortexa9-linksys_wrt32x-squashfs-sysupgrade.bin file but you make sure you check not to save the config and force if you get the option.

1 Like

Upgraded but i have big issues with my PPPOE internet connection. It is running and i cannot see any log errors or a wrong configuration but i have weird speed drops and very high latency. Internet is unusable. Not sure what happened and how to debug

No issues with the old david firmware or with AVM FRITZ!Box 4040 running the following:
|---|---|
|Architecture|ARMv7 Processor rev 5 (v7l)|
|Firmware Version|OpenWrt SNAPSHOT r15209-cdc8d4b46f / LuCI Master git-20.339.75073-e54708a|
|Kernel Version|5.4.82|

//EDIT:

I have found the issue after it reoccured:

The image is working fine but my upload was fully occupied and caused bufferbloat. High latency and slow downloads. Terrible connection. The upload was running at max speed in the meantime.

I simply could solve the issue the following way:

  • enable Smart Queue Management (Network - SQM QOS)
  • Change the interface to WAN
  • Select the right speed settings and change the link layer adaption to VDSL2

Sorry again! Issue found on my side!!

@treefiddy

I have very little knowledge of PPPoE.
Can you clarify:
was it vanilla OpenWrt that is faster/stable
or
what it a previous build of mine?

is there any vanilla openwrt snapshot available for the wrt32x? Cant find it here anymore: https://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/

I will test some previous builds of yours today and let you know, no issues with davids latest builds from https://forum.openwrt.org/t/davidc502-wrt1200ac-wrt1900acx-wrt3200acm-wrt32x-builds

Somehow it takes 1-2 minutes after the reboot when the connection gets sluggish. I have enabled debug loggin in /etc/ppp/options but there is nothing critical to see in the syslogs yet. Internet is still running, just with very high latency (above 300 - 1000ms) and slow throughput...

//EDIT:

I have found the issue after it reoccured:

The image is working fine but my upload was fully occupied and caused bufferbloat. High latency and slow downloads. Terrible connection. The upload was running at max speed in the meantime.

I simply could solve the issue the following way:

  • enable Smart Queue Management (Network - SQM QOS)
  • Change the interface to WAN
  • Select the right speed settings and change the link layer adaption to VDSL2

Sorry again! Issue found on my side!!

Ok best is to pm your old (SWConfig) /etc/config/network file and I can mod it for you.

Also was you running dnscrypt on the other build you was using if so it's not added in OP's build doesn't have that included it doesn't use a kmod so you should be fine to download it via opkg as it uses openwrt's opkg servers.

as for WRT32x snapshots, there is no official snapshots due to a kernel size limit so you have to rely on community based builds for now.

Sorry for late reply though

No need to apologize, i am happy to have this build and this awesome thread!

i am embarrassed and i feel stupid but somehow the issue disappeared. Not sure if the issue has been caused by the vdsl modem in front of the router or if i did misconfigured something essential... I am unable to do more testing without my wife killing me....

The router keeps running now without issues. Syslog looks fine.. :frowning: Sorry guys about the panic.

//EDIT:

I have found the issue after it reoccured:

The image is working fine but my upload was fully occupied and caused bufferbloat. High latency and slow downloads. Terrible connection. The upload was running at max speed in the meantime.

I simply could solve the issue the following way:

  • enable Smart Queue Management (Network - SQM QOS)
  • Change the interface to WAN
  • Select the right speed settings and change the link layer adaption to VDSL2

Sorry again! Issue found on my side!!

1 Like

Check PM, i have replied.

So I took @SkewedZeppelin advice (thank you!) and got myself a cheap WRT1900AC v2, so now I won't have to worry about the kernel size anymore although I'd still like to stay with the no-nonsense build for the foreseeable future. On the new (to me ) device I installed the latest build from Jan 10, and the changelog indicates:

20210110-00

  • update to cbd67dbdcd6f45ed54a4ec382c5a8ea4d082fa84
  • enable -O2 -mthumb for userspace

I tried googling it but couldn't find a simple description for what the -O2 and -mthumb means. I figured they're compiler run-time options, but what exactly they optimize? If anyone can provide an ELI16-like explanation that would be great

TIA

@wally-walrus

OpenWrt defaults to -OS for kernel and userspace.
-OS is a GCC compiler optimization level that is similar to -O2 but with some
parts disabled that usually increase code size.
https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html

-mthumb enables use of Thumb instructions.
Thumb instructions are a subset of the usuall ARM instructions.
However the compiled code is smaller which increases cache utilization and
reduces memory usage.
On constrained systems like these, that can actually increase performance
slightly.

2 Likes

Thanks @SkewedZeppelin, so if I was to summarize both the -mthumb and -O2 switches lead to decreased code size (thus useful for the mamba kernel)...

On a somewhat unrelated note, I see you generated a new build today (Jan 14) and removed all previous ones... Aside from what's captured in the changelog, would you say this is any better than the one from Jan 10?

And lastly, I read through the thread but not sure I have this figured out - did you apply (or plan to) any patch for the cpu frequency scaling for any of the WRT targets? Reason I'm asking is when I loaded your build on mamba, I was able to run "cat /sys/devices/system/cpu/cpufreq/policy0/cpuinfo_cur_freq" and it would show 600MHz most of the time with the occasional jump to 1200MHz. I can't find any the equivalent since I moved to your build on cobra...

TIA

@wally_walrus

In this instance, both of those options have no effect on the kernel.
They are for compiling the programs.

-O2 actually increases code sizes.

would you say this is any better than the one from Jan 10

hostapd and wpa_supplicant no longer run as root!

cpu frequency scaling

I see no reason to change those defaults.

Hi @SkewedZeppelin
Something strange is going on when I flash your latest factory.img for the 1900AC v2... I do not use the sysupgrade at all, always factory.img and restore a previously saved config file. After loading the configuration file I end up with a corrupt bootloader environment, all I get when running fw_printenv is:

root@OpenWrt:~# fw_printenv
Warning: Bad CRC, using default environment
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
root@OpenWrt:~#

I was able to restore the bootloader environment by factory resetting the router (and frantically saved it) so that made me think it's not destructive.

WOW... while I was writing this it struck me that this config originated from an 1900AC v1, so perhaps this is what's causing the issue. Which file in the config backup should I remove, so I won't experience this any more?

@wally_walrus

Factory images are only meant to be flashed from the stock firmware.
Sysupgrade images are meant to be used from within OpenWrt.

There is no reason to wipe config when updating.

I also recommend you start fresh with a new config for your device.
You can extract the backup and browse the files using standard tools if you want
to reference the old configs.

@SkewedZeppelin I keep one partition on stock firmware and always flash the other one from it, that's what I meant when I said "I do not use sysupgrade at all, always factory image..."

My point was it seems like the config backup archive includes some files that are specific to the HW version (/etc/fw_env.config, /etc/config/bootenv, etc) so I should not backup the config on v1 and restore on v2

I recreated a new config for the v2 box and I'm now back in business :slight_smile:

Hi @SkewedZeppelin hope you following this and plan to build as soon as the fix is pushed upstream

@wally_walrus

The 20210120-00 builds include the patched dnsmasq.

It is why I made the 20210120-00 so soon after 20210118-00 builds.
:slight_smile:

Edit: I have updated the changelog to better reflect such changes.

thanks for your work.
btw, I am trying to build mine on yours and about patch, do you have some steps to proceed.
if I want to add one of yours ie: 0020-DNM-kconfig_hardening.patch
? patch -p 1 -i 0020-DNM-kconfig_hardening.patch ? thats it and after ''make nconfig'' etc
thanks