(From OE-Core rev: 7300254fdb6659c0a7462c64133f893d1a152850)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset
in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not
prevent s->qdev.blocksize from being 256. This stops QEMU and the guest
immediately.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-42467https://gitlab.com/qemu-project/qemu/-/issues/1813
(From OE-Core rev: 4925ac7120605d551e1b28196b4a4dab7bc72b66)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A flaw was found in the QEMU virtual crypto device while handling
data encryption/decryption requests in virtio_crypto_handle_sym_req.
There is no check for the value of `src_len` and `dst_len` in
virtio_crypto_sym_op_helper, potentially leading to a heap buffer
overflow when the two values differ.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-3180
(From OE-Core rev: 2038b5e977481cac2e9e35101a467fbd5268231e)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A flaw was found in the QEMU built-in VNC server. When a client connects
to the VNC server, QEMU checks whether the current number of connections
crosses a certain threshold and if so, cleans up the previous connection.
If the previous connection happens to be in the handshake phase and fails,
QEMU cleans up the connection again, resulting in a NULL pointer dereference
issue. This could allow a remote unauthenticated client to cause a denial
of service.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3354
(From OE-Core rev: 8f0b34f7ad5ef842d60c9b93ce2c6142d3249890)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3255
(From OE-Core rev: 886536b056230a9d72c900eacc8d1d8b44bd2836)
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
A vulnerability in the lsi53c895a device affects the latest version
of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption
bugs like stack overflow or use-after-free.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-0330
Upstream patches:
b987718bbb
(From OE-Core rev: 3be283237a9e473112430bcb614b25b7ff7e64b2)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
* it was removed from SRC_URI in:
https://git.openembedded.org/openembedded-core/commit/?id=e94d182889ca3c02df913c59f0b66b228ffe588c
(From OE-Core rev: 9bd2cd7673c2c4d2c3c99b2caffff53521c1fc78)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 351c461859df02118e9fadb57320120dfbcd97eb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This CVE is related to Windows.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0664
(From OE-Core rev: 5474b4d8c5df31abb69e1a5be01cd089405d1cce)
Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d5ce88c15183c2bf887543c8c31e9c31aaa56a1a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Upstream asked for some changes, this updates our patch to match. The differences
likely don't change our real world use.
(From OE-Core rev: 411e3f76840c06580fa8d2e764ae504b8f0ad46b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 42591e07a469cff881fa087d5251a8c783897634)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
See the patch for more details, fixes a regression in qemu causing
illegal instructions in libm on powerpc, triggered by a libinput
upgrade.
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=f1c56cdff09f650ad721fae026eb6a3651631f3d
was the glibc code generating the instruction and triggering the issue.
(From OE-Core rev: 6a19b4a5f6eb7138ec6e79acf5c85c5d38f22d8f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
qemu 6.2 deprecated the configure option '--enable-trace-backend' in favor
of '--enable-trace-backends' [1]
Rename accordingly.
[1] https://wiki.qemu.org/ChangeLog/6.2#Build_Information
(From OE-Core rev: 9e41fac1c2ee15aaff9926dac3c0233430adff12)
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The qemu build system enables the 'log' trace backend by default, if no
explicit choice was made with '--enable-trace-backend=CHOICE'.
However, the qemu recipe uses the following PACKAGECONFIG line:
PACKAGECONFIG[ust] = "--enable-trace-backend=ust,--enable-trace-backend=nop,lttng-ust,"
which means that the 'nop' trace backend will be explicitly selected if the
'ust' feature is not enabled. The 'nop' backend removes almost all trace
points at compile time, and thus basically means 'disable tracing'.
To retain the default trace backend if 'ust' is not enabled, the above
PACKAGECONFIG line should either explicitly fall back to the 'log' backend,
or not provide any value for the 'disabled' case. This commit chooses the
latter to not make any assumption about the upstream default.
(From OE-Core rev: c31396a30dcf17ab23ff4dd5943eef5fba20cba6)
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
'#line' directives written by qemu's tracetool makes the 'debug' package not
reproducible due to absolute paths. Apply a patch to use a relative path
instead.
(From OE-Core rev: 85e30c507b63fa9126887dc6435d1ee6e23bd887)
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Split out the QEMU guest agent into a separate package. The agent is
intended to be installed within a QEMU VM guest where a user is likely
to not want to have the rest of the QEMU installation within it.
Additionally, an initscript, udev rules file, and systemd unit file are
added to the package so that the guest agent can start automatically;
the former two come from Debian's packaging for qemu-guest-agent.
(From OE-Core rev: d62fd31c70a9161596594f43c58c73898bfcf52c)
Signed-off-by: Brenda Streiff <brenda.streiff@ni.com>
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When building native qemu with 6.2 kernel headers, qemu fails to build:
In file included from /usr/include/linux/btrfs.h:29,
from ../qemu-7.2.0/linux-user/syscall.c:165:
/usr/include/linux/fs.h:50:8: error: redefinition of ‘struct file_clone_range’
50 | struct file_clone_range {
| ^~~~~~~~~~~~~~~~
../qemu-7.2.0/linux-user/syscall.c:129:8: note: originally defined here
129 | struct file_clone_range {
| ^~~~~~~~~~~~~~~~
Backport changes to linux-user that remove the local copy of struct
file_clone_range.
Patches from https://lore.kernel.org/qemu-devel/20230110174901.2580297-1-berrange@redhat.com/
(From OE-Core rev: 65b1e199dcaabf93bae33e06727bb1238b703d83)
Signed-off-by: Joel Stanley <joel@jms.id.au>
Tested-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Not only break when not in a loop is undefined, different
shells do different things when they see it.
(From OE-Core rev: 11c034b427c4d44f4013fa4ddf7c3d1264bab219)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
qemu no longer carries libslirp in-tree,
so enabling slirp requires providing external libslirp.
Another noteworthy change is:
x86: TCG support for AVX, AVX2, F16C, FMA3 and VAES instructions
... which means both meta-intel and qemu x86 targets can
now fully utilize Haswell-and-later instruction set with benefits
for performance in emulation and on silicon.
Changelog:
https://wiki.qemu.org/ChangeLog/7.2
(From OE-Core rev: d82e521995832580e990c0c173651aafd43d299c)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
drop using lfs64 specific functions and macros
(From OE-Core rev: 82fd98d6d8de17424ed9f129a1661645253ef7ae)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If the host has libpng, because of the way we handle the GL dependency in qemu,
it can cause determinism issues. Add a specific PACKAGECONFIG entry for libpng
to avoid this (and the associated autobuilder/uninative glibc symbol mismatch
failures).
(From OE-Core rev: 34afdd0bf5e2810d440bcd378ba1023159c2b2d0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The eliminates having to do extra steps (e.g. meta-ide-support)
when booting an image with a nfs mount as rootfs - startng runqemu
with a nfs mount starts to 'just work' after building an image.
(From OE-Core rev: f73e370bec16d206592a7ca01b4a86b1d1316ada)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The previous version of this wasn't correctly passing the program name
as argv[0], and was also over-complicated anyway because argv[] is
guaranteed to be terminated with a NULL pointer, so it can be passed
directly to the execv'd process without needing to be copied.
(From OE-Core rev: 6edf38add3c20c44efe0588e2815bb280d22e0c4)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bridge helper program is invoked directly from QEMU when it needs to
attach to a network bridge. As such, it is subject to the environment of
QEMU itself. Specifically, if bridging is enabled with direct rendering
acceleration, QEMU is run with an LD_PRELOAD that attempts to preload
several uninative libraries; however /bin/sh doesn't use the uninative
loader which means it can fail to start with an error like:
/bin/sh: symbol lookup error: sysroots-uninative/x86_64-linux/lib/librt.so.1: undefined symbol: __libc_unwind_link_get, version GLIBC_PRIVATE
Converting the helper program to a C program resolves this problem
because it will now use the uninative loader so the preload doesn't
cause errors.
(From OE-Core rev: f698e98f2f09952b34488b8cf9e73e82bd7aea07)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With libjack-devel or jack-audio-connection-kit-devel, qemu-native
detects the library/header and tries to build with it. Since its
missing from the sysroot, it fails to build.
-O2 -fPIE -D_REENTRANT -Wno-undef -MD -MQ libcommon.fa.p/audio_jackaudio.c.o
-MF libcommon.fa.p/audio_jackaudio.c.o.d -o libcommon.fa.p/audio_jackaudio.c.o
-c ../qemu-6.2.0/audio/jackaudio.c
| ../qemu-6.2.0/audio/jackaudio.c:34:10: fatal error: jack/jack.h: No such file
or directory
| 34 | #include <jack/jack.h>
| | ^~~~~~~~~~~~~
| compilation terminated.
(From OE-Core rev: 27260be388f7f9f324ff405e7d8e254925b4ae90)
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upgrading qemu to 7.1.0 caused some issues in meta-arm for optee and
for zephyr as well:
https://github.com/OP-TEE/optee_os/issues/5551
Add in a patch being proposed to address the issue.
(From OE-Core rev: ec41bf3cf0d55c84db07069561a6807bc96fa95b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport the fix for CVE-2022-2962.
(From OE-Core rev: 943d28a3395455fd475cb6c84247d106adf5fca3)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch was accidentally dropped in the 7.1.0 upgrade, so bring it
back.
(From OE-Core rev: 09bcf6d2a661a3c39fdd13a760f6c26dd79abb69)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop CVE backports and backported patch for pvrdma which was also applied upstream.
Refresh cross.patch.
Drop vnc-png option removed upstream.
Update ptest path manipulations for target.
qmp now has consists of multiple files so install them all as a python module.
The upgrade contains fixes for virtio block devices which we hope will
address vda device tracebacks on the autobuilder from qemu.
(From OE-Core rev: e94d182889ca3c02df913c59f0b66b228ffe588c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
io_uring is enabled or disabled depending on whether liburing is available,
so add a PACKAGECONFIG to make this explicit, disabled by default.
(From OE-Core rev: daee79639c39ac6278855b35e0ddf71e52dd13f8)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a PACKAGECONFIG option for slirp, defaulting to internal. This avoids
the presence of libslirp on the host causing qemu to link against that
instead breaking reproducibility and usability of the binary on hosts
where the library isn't present.
We need to add it to PACKAGECONFIG by default since users do expect slirp
to be enabled in the wider community.
(From OE-Core rev: 5a9a64132bf5ecac9d611d29751226a466c4a2c1)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Avoid accidentally linking to the vde library from the host by
adding a PACKAGECONFIG for the option.
(From OE-Core rev: 8839e9540528b0b46c4fb4f95e508f038bcef8b9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Avoid accidentally linking to the rdma library from the host by
adding a PACKAGECONFIG for the option. This was found on new
Fedora 36 autobuilder workers.
(From OE-Core rev: 2a0f3cb225e4d5471155abbcd05d09bd6bf1620f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Autobuilder workers were non-deterministically enabling capstone
depending on whether the worker had libcapstone installed.
Add PACKAGECONFIG for capstone with default off, since qemu does not
require capstone support.
Qemu version in dunfell has capstone in the source tree as a submodule
and has configure options to enable it using that source code or using
the system libcapstone.
Qemu versions in master and kirkstone have removed the capstone
submodule and configure options, but added libcapstone autodetection to
meson.
In all cases using PACKAGECONFIG will allow a deterministic build.
(From OE-Core rev: 052ef1f14d1e6a5ee34f742f65e51b20b416f79f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This reverts commit 9d05227e910d3f374ba7a9763ff2584b9e40db61.
This is no longer needed with a patch to importlib in python.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop xfs/libxml2 options no longer offered upstream.
Dropped patches all found their way upstream, particularly
0001-qemu-Add-missing-wacom-HID-descriptor.patch as well.
(From OE-Core rev: ab6bd34a07d10583aeb9377a7fdb9392242b6a8c)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
its in auto mode, which is troublesome particularly on native recipe
where it pokes at build host to find this library if its not in native
sysroot and when build host has libbpf installed it enables it silently
otherwise disables the support. so lets make it deterministic, and if
one needs to enable this feature then enable the packageconfig
intentionally, It was found when trying to solve this QA warning
Skipping RPATH /usr/lib64 as is a standard search path for /mnt/b/yoe/master/build/tmp/work/x86_64-linux/qemu-system-native/6.2.0-
r0/sysroot-destdir/mnt/b/yoe/master/build/tmp/work/x86_64-linux/qemu-system-native/6.2.0-r0/recipe-sysroot-native/usr/bin/qemu-system-x86_64
This is becasue qemu's build system adds the needed flags to -rpath for
the libraries it needs and in this case it has found libbpf.so in
/usr/lib64 on build host.
(From OE-Core rev: 3d493928b7c98ab11b5d8c50924b1a2c464bf7f5)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport a patch from upstream (will be in qemu 7.0) to add an option to
disable the legacy i8042 support (AT keyboard, PS/2 mouse). These
devices are very historical and modern Linux environments use USB anyway.
(From OE-Core rev: d73e4fcfc9ca4aab25f7751ba17974a839d6340f)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a fix queued upstream for the issue in this CVE:
"""
Guest driver might execute HW commands when shared buffers are not yet
allocated.
This might happen on purpose (malicious guest) or because some other
guest/host address mapping.
We need to protect againts such case.
"""
(From OE-Core rev: 1b8513c1abdcd6430f9311efd04d785488f79d7d)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
