kernel: update to 3.10.9.

use intel config from IPFire 3.x branch.
arm cfg is not present yet and some patches are missing.

lfs/linux

@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.2.48
+VER        = 3.10.9
 
 RPI_PATCHES = linux-3.2.27-ada8b44
 
@@ -35,7 +35,7 @@ DIR_APP    = $(DIR_SRC)/$(THISAPP)
 CFLAGS     =
 CXXFLAGS   =
 
-PAK_VER    = 30
+PAK_VER    = 31
 DEPS	   = ""
 
 VERSUFIX=ipfire$(KCFG)
@@ -71,7 +71,7 @@ objects =$(DL_FILE) \
 $(DL_FILE)				= $(URL_IPFIRE)/$(DL_FILE)
 rpi-patches-$(RPI_PATCHES).patch.xz	= $(URL_IPFIRE)/rpi-patches-$(RPI_PATCHES).patch.xz
 
-$(DL_FILE)_MD5				= f560aa5fcf07e57ea0ca66fdfdb53ef1
+$(DL_FILE)_MD5				= 28d1e1117c30fdd861f70ac0f9b677aa
 rpi-patches-$(RPI_PATCHES).patch.xz_MD5	= 966687ff27e450e04ff50e0da829dc00
 
 
@@ -109,16 +109,29 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	ln -svf linux-$(VER) $(DIR_SRC)/linux
 
 	# Linux Intermediate Queueing Device
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.2-imq.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/imq_kernel3.10.patch
 
 	# ipp2p 0.8.2-ipfire
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.0-ipp2p-0.8.2-ipfire.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10-ipp2p-0.8.2-ipfire.patch
 
 	# Layer7-patch
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/netfilter_layer7_2.22_kernel3.0.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/netfilter_layer7_2.22_kernel3.10-no_proc_interface.patch
+
+	# Grsecurity-patches
+ifneq "$(KCFG)" "-headers"
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/grsecurity-2.9.1-3.10.9-201308202015.patch
+	cd $(DIR_APP) && rm localversion-grsec
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.7-disable-compat_vdso.patch
+endif
+
+	# Disable pcspeaker autoload
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.30-no-pcspkr-modalias.patch
+
+	# Remove ACPI Blacklist message
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6-silence-acpi-blacklist.patch
 
 	# Add LED trigger
-	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.2.33-ledtrig-netdev-1.patch
+#	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.2.33-ledtrig-netdev-1.patch
 
 	# Fix uevent PHYSDEVDRIVER
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.2.33_ipg-fix-driver-name.patch
@@ -220,11 +233,9 @@ ifeq "$(LASTKERNEL)" "1"
 	echo "options ipv6 disable_ipv6=1" > /etc/modprobe.d/ipv6
 endif
 
-ifneq "$(MACHINE_TYPE)" "arm"
-	# Disable geode_aes modul
-	mv /lib/modules/$(VER)-$(VERSUFIX)/kernel/drivers/crypto/geode-aes.ko \
+	# Disable geode_aes modul if exist
+	-mv /lib/modules/$(VER)-$(VERSUFIX)/kernel/drivers/crypto/geode-aes.ko \
            /lib/modules/$(VER)-$(VERSUFIX)/kernel/drivers/crypto/geode-aes.ko.off
-endif
 endif
 
 	@rm -rf $(DIR_SRC)/patch-o-matic* $(DIR_SRC)/iptables* $(DIR_SRC)/squashfs* $(DIR_SRC)/netfilter-layer7-*

lfs/net-tools

@@ -70,12 +70,14 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/$(THISAPP)-gcc34-3.patch
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/$(THISAPP)-kernel_headers-2.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/$(THISAPP)-kernel_headers-3.patch
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/$(THISAPP)-mii_ioctl-1.patch
 	cd $(DIR_APP) && yes "" | make config
 	cd $(DIR_APP) && sed -i	-e 's|HAVE_IP_TOOLS 0|HAVE_IP_TOOLS 1|g' \
+				-e 's|HAVE_HWSTRIP 1|HAVE_HWSTRIP 0|g' \
 					-e 's|HAVE_MII 0|HAVE_MII 1|g' config.h
 	cd $(DIR_APP) && sed -i	-e 's|# HAVE_IP_TOOLS=0|HAVE_IP_TOOLS=1|g' \
+				-e 's|HAVE_HWSTRIP 1|HAVE_HWSTRIP 0|g' \
 					-e 's|# HAVE_MII=0|HAVE_MII=1|g' config.make
 	cd $(DIR_APP) && make
 	cd $(DIR_APP) && make update

make.sh

@@ -378,6 +378,7 @@ buildipfire() {
   ipfiremake zd1211-firmware
   ipfiremake rpi-firmware
   ipfiremake u-boot
+  ipfiremake bc
 
   if [ "${MACHINE_TYPE}" != "arm" ]; then
 
@@ -396,29 +397,29 @@ buildipfire() {
 
     # x86-pae (Native and new XEN) kernel build
     ipfiremake linux			KCFG="-pae"
-    ipfiremake kvm-kmod			KCFG="-pae"
-    ipfiremake v4l-dvb			KCFG="-pae"
-    ipfiremake mISDN			KCFG="-pae"
+#    ipfiremake kvm-kmod			KCFG="-pae"
+#    ipfiremake v4l-dvb			KCFG="-pae"
+#    ipfiremake mISDN			KCFG="-pae"
     ipfiremake cryptodev		KCFG="-pae"
-    ipfiremake compat-drivers		KCFG="-pae"
-    ipfiremake r8169			KCFG="-pae"
-    ipfiremake r8168			KCFG="-pae"
-    ipfiremake r8101			KCFG="-pae"
-    ipfiremake e1000e			KCFG="-pae"
-    ipfiremake igb			KCFG="-pae"
+#    ipfiremake compat-drivers		KCFG="-pae"
+#    ipfiremake r8169			KCFG="-pae"
+#    ipfiremake r8168			KCFG="-pae"
+#    ipfiremake r8101			KCFG="-pae"
+#    ipfiremake e1000e			KCFG="-pae"
+#    ipfiremake igb			KCFG="-pae"
 
     # x86 kernel build
     ipfiremake linux			KCFG=""
-    ipfiremake kvm-kmod			KCFG=""
-    ipfiremake v4l-dvb			KCFG=""
-    ipfiremake mISDN			KCFG=""
+#    ipfiremake kvm-kmod			KCFG=""
+#    ipfiremake v4l-dvb			KCFG=""
+#    ipfiremake mISDN			KCFG=""
     ipfiremake cryptodev		KCFG=""
-    ipfiremake compat-drivers		KCFG=""
-    ipfiremake r8169			KCFG=""
-    ipfiremake r8168			KCFG=""
-    ipfiremake r8101			KCFG=""
-    ipfiremake e1000e			KCFG=""
-    ipfiremake igb			KCFG=""
+#    ipfiremake compat-drivers		KCFG=""
+#    ipfiremake r8169			KCFG=""
+#    ipfiremake r8168			KCFG=""
+#    ipfiremake r8101			KCFG=""
+#    ipfiremake e1000e			KCFG=""
+#    ipfiremake igb			KCFG=""
 
   else
     # arm-rpi (Raspberry Pi) kernel build
@@ -599,7 +600,7 @@ buildipfire() {
   ipfiremake sudo
   ipfiremake mc
   ipfiremake wget
-  ipfiremake bridge-utils
+#  ipfiremake bridge-utils
   ipfiremake screen
   ipfiremake smartmontools
   ipfiremake htop
@@ -678,7 +679,6 @@ buildipfire() {
   ipfiremake mpc
   ipfiremake git
   ipfiremake squidclamav
-  ipfiremake bc
   ipfiremake vnstat
   ipfiremake vnstati
   ipfiremake iw
@@ -730,7 +730,7 @@ buildipfire() {
   ipfiremake minicom
   ipfiremake ddrescue
   ipfiremake imspector
-  ipfiremake miniupnpd
+#  ipfiremake miniupnpd
   ipfiremake client175
   ipfiremake powertop
   ipfiremake parted
@@ -774,7 +774,7 @@ buildipfire() {
   ipfiremake lcdproc
   ipfiremake bitstream
   ipfiremake multicat
-  ipfiremake keepalived
+#  ipfiremake keepalived
   ipfiremake ipvsadm
   ipfiremake perl-Carp-Clan
   ipfiremake perl-Date-Calc

src/patches/linux-2.6-silence-acpi-blacklist.patch

@@ -0,0 +1,25 @@
+diff -up linux-2.6.26.noarch/drivers/acpi/blacklist.c.jx linux-2.6.26.noarch/drivers/acpi/blacklist.c
+--- linux-2.6.26.noarch/drivers/acpi/blacklist.c.jx	2008-07-13 17:51:29.000000000 -0400
++++ linux-2.6.26.noarch/drivers/acpi/blacklist.c	2008-08-12 14:21:39.000000000 -0400
+@@ -81,18 +81,18 @@ static int __init blacklist_by_year(void
+ 
+ 	/* Doesn't exist? Likely an old system */
+ 	if (!dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL)) {
+-		printk(KERN_ERR PREFIX "no DMI BIOS year, "
++		printk(KERN_INFO PREFIX "no DMI BIOS year, "
+ 			"acpi=force is required to enable ACPI\n" );
+ 		return 1;
+ 	}
+ 	/* 0? Likely a buggy new BIOS */
+ 	if (year == 0) {
+-		printk(KERN_ERR PREFIX "DMI BIOS year==0, "
++		printk(KERN_INFO PREFIX "DMI BIOS year==0, "
+ 			"assuming ACPI-capable machine\n" );
+ 		return 0;
+ 	}
+ 	if (year < CONFIG_ACPI_BLACKLIST_YEAR) {
+-		printk(KERN_ERR PREFIX "BIOS age (%d) fails cutoff (%d), "
++		printk(KERN_INFO PREFIX "BIOS age (%d) fails cutoff (%d), "
+ 		       "acpi=force is required to enable ACPI\n",
+ 		       year, CONFIG_ACPI_BLACKLIST_YEAR);
+ 		return 1;

src/patches/linux-2.6.30-no-pcspkr-modalias.patch

@@ -0,0 +1,12 @@
+diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
+index 34f4d2e..3e40c70 100644
+--- a/drivers/input/misc/pcspkr.c
++++ b/drivers/input/misc/pcspkr.c
+@@ -24,7 +24,6 @@
+ MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
+ MODULE_DESCRIPTION("PC Speaker beeper driver");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("platform:pcspkr");
+ 
+ static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
+ {

src/patches/linux-3.7-disable-compat_vdso.patch

@@ -0,0 +1,46 @@
+No need to wrap vdso calls as gentoo does not use any version of 
+glibc <=2.3.3
+---
+From: Gordon Malm <gengor@gentoo.org>
+From: Kerin Millar <kerframil@gmail.com>
+From: Jory A. Pratt	<anarchy@gentoo.org>
+
+COMPAT_VDSO is inappropriate for any modern Hardened Gentoo system. It
+conflicts with various parts of PaX, crashing the system if enabled
+while PaX's NOEXEC or UDEREF features are active. Moreover, it prevents
+a number of important PaX options from appearing in the configuration
+menu, including all PaX NOEXEC implementations. Unfortunately, the
+reason for the disappearance of these PaX configuration options is
+often far from obvious to inexperienced users.
+
+Therefore, we disable the COMPAT_VDSO menu entry entirely. However,
+COMPAT_VDSO operation can still be enabled via bootparam and sysctl
+interfaces. Consequently, we must also disable the ability to select
+COMPAT_VDSO operation at boot or runtime. Here we patch the kernel so
+that selecting COMPAT_VDSO operation at boot/runtime has no effect if
+conflicting PaX options are enabled, leaving VDSO_ENABLED operation
+intact.
+
+Closes bug: http://bugs.gentoo.org/show_bug.cgi?id=210138
+
+diff -urp a/arch/x86/Kconfig b/arch/x86/Kconfig
+--- a/arch/x86/Kconfig	2009-07-31 01:36:57.323857684 +0100
++++ b/arch/x86/Kconfig	2009-07-31 01:51:39.395749681 +0100
+@@ -1651,17 +1651,8 @@
+ 
+ config COMPAT_VDSO
+ 	def_bool n
+-	prompt "Compat VDSO support"
+ 	depends on X86_32 || IA32_EMULATION
+ 	depends on !PAX_PAGEEXEC && !PAX_SEGMEXEC && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
+-	---help---
+-	  Map the 32-bit VDSO to the predictable old-style address too.
+-
+-	  Say N here if you are running a sufficiently recent glibc
+-	  version (2.3.3 or later), to remove the high-mapped
+-	  VDSO mapping and to exclusively use the randomized VDSO.
+-
+-	  If unsure, say Y.
+ 
+ config CMDLINE_BOOL
+ 	bool "Built-in kernel command line"

src/patches/net-tools-1.60-kernel_headers-3.patch

@@ -0,0 +1,55 @@
+diff -Naur net-tools-1.60.org/hostname.c net-tools-1.60/hostname.c
+--- net-tools-1.60.org/hostname.c	2001-04-08 19:04:23.000000000 +0200
++++ net-tools-1.60/hostname.c	2013-08-26 11:56:50.131844273 +0200
+@@ -42,10 +42,16 @@
+ #include "config.h"
+ #include "version.h"
+ #include "../intl.h"
++#include <linux/version.h>
+ 
+ #if HAVE_AFDECnet
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+ #include <netdnet/dn.h>
+ #endif
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
++#include <linux/dn.h>
++#endif
++#endif
+ 
+ char *Release = RELEASE, *Version = "hostname 1.100 (2001-04-14)";
+ 
+diff -Naur net-tools-1.60.org/lib/tr.c net-tools-1.60/lib/tr.c
+--- net-tools-1.60.org/lib/tr.c	2000-02-20 22:46:45.000000000 +0100
++++ net-tools-1.60/lib/tr.c	2013-08-26 11:57:33.675175033 +0200
+@@ -20,7 +20,7 @@
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <net/if_arp.h>
+-#include <linux/if_tr.h>
++#include <netinet/if_tr.h>
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <errno.h>
+diff -Naur net-tools-1.60.org/lib/x25_sr.c net-tools-1.60/lib/x25_sr.c
+--- net-tools-1.60.org/lib/x25_sr.c	2000-05-20 15:38:10.000000000 +0200
++++ net-tools-1.60/lib/x25_sr.c	2013-08-26 11:56:50.131844273 +0200
+@@ -22,6 +22,7 @@
+ #include <sys/socket.h>
+ #include <sys/ioctl.h>
+ #include <linux/x25.h>
++#include <linux/version.h>
+ #include <ctype.h>
+ #include <errno.h>
+ #include <netdb.h>
+@@ -77,7 +78,11 @@
+   rt.sigdigits=sigdigits;
+ 
+   /* x25_route_struct.address isn't type struct sockaddr_x25, Why? */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+   memcpy(&rt.address, &sx25.sx25_addr, sizeof(x25_address));
++#else
++  memcpy(&rt.address, &sx25.sx25_addr, sizeof(struct x25_address));
++#endif
+ 
+   while (*args) {
+ 	if (!strcmp(*args,"device") || !strcmp(*args,"dev")) {