* [OE-core][scarthgap 00/10] Patch review
@ 2024-11-07 3:37 Steve Sakoman
2024-11-07 3:37 ` [OE-core][scarthgap 01/10] cve-check: add support for cvss v4.0 Steve Sakoman
` (9 more replies)
0 siblings, 10 replies; 25+ messages in thread
From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for scarthgap and have comments back by
end of day Friday, November 8
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/400
The following changes since commit bcd4e6d77dc7455a453e69b6d37769ec94cc02ad:
lsb-release: fix Distro Codename shell escaping (2024-10-24 06:09:29 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Aditya Tayade (1):
e2fsprogs: removed 'sed -u' option
Deepthi Hemraj (1):
rust-llvm: Fix CVE-2024-0151
Hiago De Franco (1):
weston: backport patch to allow neatvnc < v0.9.0
Martin Jansa (1):
python3-lxml=v5.0.2
Peter Marko (3):
cve-check: add support for cvss v4.0
go: upgrade 1.22.6 -> 1.22.7
go: upgrade 1.22.7 -> 1.22.8
Richard Purdie (1):
cve_check: Use a local copy of the database during builds
Vijay Anusuri (1):
xserver-xorg: upgrade 21.1.13 -> 21.1.14
Wang Mingyu (1):
orc: upgrade 0.4.39 -> 0.4.40
meta/classes/cve-check.bbclass | 16 +-
.../meta/cve-update-nvd2-native.bb | 32 +-
.../e2fsprogs/e2fsprogs/run-ptest | 3 +-
.../go/{go-1.22.6.inc => go-1.22.8.inc} | 2 +-
...e_1.22.6.bb => go-binary-native_1.22.8.bb} | 6 +-
..._1.22.6.bb => go-cross-canadian_1.22.8.bb} | 0
...{go-cross_1.22.6.bb => go-cross_1.22.8.bb} | 0
...osssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} | 0
...runtime_1.22.6.bb => go-runtime_1.22.8.bb} | 0
.../go/{go_1.22.6.bb => go_1.22.8.bb} | 0
.../orc/{orc_0.4.39.bb => orc_0.4.40.bb} | 2 +-
...n3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} | 3 +-
.../0004-llvm-Fix-CVE-2024-0151.patch | 1086 +++++++++++++++++
.../recipes-devtools/rust/rust-llvm_1.75.0.bb | 3 +-
...1-vnc-Allow-neatvnc-in-version-0.8.0.patch | 27 +
.../recipes-graphics/wayland/weston_13.0.1.bb | 1 +
...org_21.1.13.bb => xserver-xorg_21.1.14.bb} | 2 +-
17 files changed, 1158 insertions(+), 25 deletions(-)
rename meta/recipes-devtools/go/{go-1.22.6.inc => go-1.22.8.inc} (89%)
rename meta/recipes-devtools/go/{go-binary-native_1.22.6.bb => go-binary-native_1.22.8.bb} (78%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.22.6.bb => go-cross-canadian_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.22.6.bb => go-cross_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.22.6.bb => go-runtime_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go_1.22.6.bb => go_1.22.8.bb} (100%)
rename meta/recipes-devtools/orc/{orc_0.4.39.bb => orc_0.4.40.bb} (92%)
rename meta/recipes-devtools/python/{python3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} (94%)
create mode 100644 meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.13.bb => xserver-xorg_21.1.14.bb} (92%)
--
2.34.1
^ permalink raw reply [flat|nested] 25+ messages in thread* [OE-core][scarthgap 01/10] cve-check: add support for cvss v4.0 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds Steve Sakoman ` (8 subsequent siblings) 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Peter Marko <peter.marko@siemens.com> https://nvd.nist.gov/general/news/cvss-v4-0-official-support CVSS v4.0 was released in November 2023 NVD announced support for it in June 2024 Current stats are: * cvss v4 provided, but also v3, so cve-check showed a value sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 != 0.0; 2069 * only cvss v4 provided, so cve-check did not show any sqlite> select count(*) from nvd where scorev4 != 0.0 and scorev3 = 0.0; 260 (From OE-Core rev: 358dbfcd80ae1fa414d294c865dd293670c287f0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/classes/cve-check.bbclass | 11 +++++++---- meta/recipes-core/meta/cve-update-nvd2-native.bb | 14 ++++++++++---- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 93a2a1413d..d287cf1457 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -32,7 +32,7 @@ CVE_PRODUCT ??= "${BPN}" CVE_VERSION ??= "${PV}" CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2-1.db" +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2-2.db" CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" CVE_CHECK_LOG ?= "${T}/cve.log" @@ -447,9 +447,10 @@ def get_cve_info(d, cves): cve_data[row[0]]["summary"] = row[1] cve_data[row[0]]["scorev2"] = row[2] cve_data[row[0]]["scorev3"] = row[3] - cve_data[row[0]]["modified"] = row[4] - cve_data[row[0]]["vector"] = row[5] - cve_data[row[0]]["vectorString"] = row[6] + cve_data[row[0]]["scorev4"] = row[4] + cve_data[row[0]]["modified"] = row[5] + cve_data[row[0]]["vector"] = row[6] + cve_data[row[0]]["vectorString"] = row[7] cursor.close() conn.close() return cve_data @@ -514,6 +515,7 @@ def cve_write_data_text(d, patched, unpatched, ignored, cve_data): write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"] write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["scorev2"] write_string += "CVSS v3 BASE SCORE: %s\n" % cve_data[cve]["scorev3"] + write_string += "CVSS v4 BASE SCORE: %s\n" % cve_data[cve]["scorev4"] write_string += "VECTOR: %s\n" % cve_data[cve]["vector"] write_string += "VECTORSTRING: %s\n" % cve_data[cve]["vectorString"] write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve) @@ -631,6 +633,7 @@ def cve_write_data_json(d, patched, unpatched, ignored, cve_data, cve_status): "summary" : cve_data[cve]["summary"], "scorev2" : cve_data[cve]["scorev2"], "scorev3" : cve_data[cve]["scorev3"], + "scorev4" : cve_data[cve]["scorev4"], "vector" : cve_data[cve]["vector"], "vectorString" : cve_data[cve]["vectorString"], "status" : status, diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb b/meta/recipes-core/meta/cve-update-nvd2-native.bb index 1901641965..92177712dc 100644 --- a/meta/recipes-core/meta/cve-update-nvd2-native.bb +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb @@ -247,7 +247,7 @@ def initialize_db(conn): c.execute("CREATE TABLE IF NOT EXISTS META (YEAR INTEGER UNIQUE, DATE TEXT)") c.execute("CREATE TABLE IF NOT EXISTS NVD (ID TEXT UNIQUE, SUMMARY TEXT, \ - SCOREV2 TEXT, SCOREV3 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)") + SCOREV2 TEXT, SCOREV3 TEXT, SCOREV4 TEXT, MODIFIED INTEGER, VECTOR TEXT, VECTORSTRING TEXT)") c.execute("CREATE TABLE IF NOT EXISTS PRODUCTS (ID TEXT, \ VENDOR TEXT, PRODUCT TEXT, VERSION_START TEXT, OPERATOR_START TEXT, \ @@ -353,12 +353,18 @@ def update_db(conn, elt): cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore'] except KeyError: pass + cvssv3 = cvssv3 or 0.0 + try: + accessVector = accessVector or elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['attackVector'] + vectorString = vectorString or elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['vectorString'] + cvssv4 = elt['cve']['metrics']['cvssMetricV40'][0]['cvssData']['baseScore'] + except KeyError: + cvssv4 = 0.0 accessVector = accessVector or "UNKNOWN" vectorString = vectorString or "UNKNOWN" - cvssv3 = cvssv3 or 0.0 - conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?)", - [cveId, cveDesc, cvssv2, cvssv3, date, accessVector, vectorString]).close() + conn.execute("insert or replace into NVD values (?, ?, ?, ?, ?, ?, ?, ?)", + [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close() try: # Remove any pre-existing CVE configuration. Even for partial database -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 01/10] cve-check: add support for cvss v4.0 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-26 13:02 ` Vincent Prince 2024-11-07 3:37 ` [OE-core][scarthgap 03/10] rust-llvm: Fix CVE-2024-0151 Steve Sakoman ` (7 subsequent siblings) 9 siblings, 1 reply; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Richard Purdie <richard.purdie@linuxfoundation.org> Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from a local copy in STAGING DIR after fetching. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 03596904392d257572a905a182b92c780d636744) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/classes/cve-check.bbclass | 7 ++++--- .../meta/cve-update-nvd2-native.bb | 18 +++++++++++++----- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index d287cf1457..ed219bf472 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -31,8 +31,9 @@ CVE_PRODUCT ??= "${BPN}" CVE_VERSION ??= "${PV}" -CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2-2.db" +CVE_CHECK_DB_FILENAME ?= "nvdcve_2-2.db" +CVE_CHECK_DB_DIR ?= "${STAGING_DIR}/CVE_CHECK" +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/${CVE_CHECK_DB_FILENAME}" CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" CVE_CHECK_LOG ?= "${T}/cve.log" @@ -198,7 +199,7 @@ python do_cve_check () { } addtask cve_check before do_build -do_cve_check[depends] = "cve-update-nvd2-native:do_fetch" +do_cve_check[depends] = "cve-update-nvd2-native:do_unpack" do_cve_check[nostamp] = "1" python cve_check_cleanup () { diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb b/meta/recipes-core/meta/cve-update-nvd2-native.bb index 92177712dc..5fbe9095cc 100644 --- a/meta/recipes-core/meta/cve-update-nvd2-native.bb +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb @@ -8,7 +8,6 @@ INHIBIT_DEFAULT_DEPS = "1" inherit native -deltask do_unpack deltask do_patch deltask do_configure deltask do_compile @@ -35,7 +34,9 @@ CVE_DB_INCR_UPDATE_AGE_THRES ?= "10368000" # Number of attempts for each http query to nvd server before giving up CVE_DB_UPDATE_ATTEMPTS ?= "5" -CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_2.db" +CVE_CHECK_DB_DLDIR_FILE ?= "${DL_DIR}/CVE_CHECK/${CVE_CHECK_DB_FILENAME}" +CVE_CHECK_DB_DLDIR_LOCK ?= "${CVE_CHECK_DB_DLDIR_FILE}.lock" +CVE_CHECK_DB_TEMP_FILE ?= "${CVE_CHECK_DB_FILE}.tmp" python () { if not bb.data.inherits_class("cve-check", d): @@ -52,9 +53,9 @@ python do_fetch() { bb.utils.export_proxies(d) - db_file = d.getVar("CVE_CHECK_DB_FILE") + db_file = d.getVar("CVE_CHECK_DB_DLDIR_FILE") db_dir = os.path.dirname(db_file) - db_tmp_file = d.getVar("CVE_DB_TEMP_FILE") + db_tmp_file = d.getVar("CVE_CHECK_DB_TEMP_FILE") cleanup_db_download(db_file, db_tmp_file) # By default let's update the whole database (since time 0) @@ -77,6 +78,7 @@ python do_fetch() { pass bb.utils.mkdirhier(db_dir) + bb.utils.mkdirhier(os.path.dirname(db_tmp_file)) if os.path.exists(db_file): shutil.copy2(db_file, db_tmp_file) @@ -89,10 +91,16 @@ python do_fetch() { os.remove(db_tmp_file) } -do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}" +do_fetch[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK}" do_fetch[file-checksums] = "" do_fetch[vardeps] = "" +python do_unpack() { + import shutil + shutil.copyfile(d.getVar("CVE_CHECK_DB_DLDIR_FILE"), d.getVar("CVE_CHECK_DB_FILE")) +} +do_unpack[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK} ${CVE_CHECK_DB_FILE_LOCK}" + def cleanup_db_download(db_file, db_tmp_file): """ Cleanup the download space from possible failed downloads -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-11-07 3:37 ` [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds Steve Sakoman @ 2024-11-26 13:02 ` Vincent Prince 2024-11-26 13:18 ` Yoann Congal 2024-11-28 16:08 ` Marta Rybczynska 0 siblings, 2 replies; 25+ messages in thread From: Vincent Prince @ 2024-11-26 13:02 UTC (permalink / raw) To: steve; +Cc: openembedded-core Hello, I'm wondering if I'm the only one who couldn't complete do_fetch of cve-update-nvd2-native with maximum retries on CVE API? I tried with or without API Key, from several different machines, I also tried to increase retries number etc, without success. I see on the NVD status page the following warning : "Due to changes described below, a large number of CVE records have recently been updated, resulting in a large increase in API requests. We are aware of the issue and are working to mitigate it. Thank you for your patience." I see the Buildroot switched from NVD to alternative FKIE github database due to that API 2.0 inconsistency :/ I'm not sure what are my options here, quite odd that cybersecurity organisation get impacted by DDoS :D Best regards, Vincent Le jeu. 7 nov. 2024 à 04:38, Steve Sakoman via lists.openembedded.org <steve=sakoman.com@lists.openembedded.org> a écrit : > > From: Richard Purdie <richard.purdie@linuxfoundation.org> > > Rtaher than trying to use a sqlite database over NFS from DL_DIR, work from > a local copy in STAGING DIR after fetching. > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> > (cherry picked from commit 03596904392d257572a905a182b92c780d636744) > Signed-off-by: Steve Sakoman <steve@sakoman.com> > --- > meta/classes/cve-check.bbclass | 7 ++++--- > .../meta/cve-update-nvd2-native.bb | 18 +++++++++++++----- > 2 files changed, 17 insertions(+), 8 deletions(-) > > diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass > index d287cf1457..ed219bf472 100644 > --- a/meta/classes/cve-check.bbclass > +++ b/meta/classes/cve-check.bbclass > @@ -31,8 +31,9 @@ > CVE_PRODUCT ??= "${BPN}" > CVE_VERSION ??= "${PV}" > > -CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" > -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2-2.db" > +CVE_CHECK_DB_FILENAME ?= "nvdcve_2-2.db" > +CVE_CHECK_DB_DIR ?= "${STAGING_DIR}/CVE_CHECK" > +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/${CVE_CHECK_DB_FILENAME}" > CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" > > CVE_CHECK_LOG ?= "${T}/cve.log" > @@ -198,7 +199,7 @@ python do_cve_check () { > } > > addtask cve_check before do_build > -do_cve_check[depends] = "cve-update-nvd2-native:do_fetch" > +do_cve_check[depends] = "cve-update-nvd2-native:do_unpack" > do_cve_check[nostamp] = "1" > > python cve_check_cleanup () { > diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb b/meta/recipes-core/meta/cve-update-nvd2-native.bb > index 92177712dc..5fbe9095cc 100644 > --- a/meta/recipes-core/meta/cve-update-nvd2-native.bb > +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb > @@ -8,7 +8,6 @@ INHIBIT_DEFAULT_DEPS = "1" > > inherit native > > -deltask do_unpack > deltask do_patch > deltask do_configure > deltask do_compile > @@ -35,7 +34,9 @@ CVE_DB_INCR_UPDATE_AGE_THRES ?= "10368000" > # Number of attempts for each http query to nvd server before giving up > CVE_DB_UPDATE_ATTEMPTS ?= "5" > > -CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_2.db" > +CVE_CHECK_DB_DLDIR_FILE ?= "${DL_DIR}/CVE_CHECK/${CVE_CHECK_DB_FILENAME}" > +CVE_CHECK_DB_DLDIR_LOCK ?= "${CVE_CHECK_DB_DLDIR_FILE}.lock" > +CVE_CHECK_DB_TEMP_FILE ?= "${CVE_CHECK_DB_FILE}.tmp" > > python () { > if not bb.data.inherits_class("cve-check", d): > @@ -52,9 +53,9 @@ python do_fetch() { > > bb.utils.export_proxies(d) > > - db_file = d.getVar("CVE_CHECK_DB_FILE") > + db_file = d.getVar("CVE_CHECK_DB_DLDIR_FILE") > db_dir = os.path.dirname(db_file) > - db_tmp_file = d.getVar("CVE_DB_TEMP_FILE") > + db_tmp_file = d.getVar("CVE_CHECK_DB_TEMP_FILE") > > cleanup_db_download(db_file, db_tmp_file) > # By default let's update the whole database (since time 0) > @@ -77,6 +78,7 @@ python do_fetch() { > pass > > bb.utils.mkdirhier(db_dir) > + bb.utils.mkdirhier(os.path.dirname(db_tmp_file)) > if os.path.exists(db_file): > shutil.copy2(db_file, db_tmp_file) > > @@ -89,10 +91,16 @@ python do_fetch() { > os.remove(db_tmp_file) > } > > -do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}" > +do_fetch[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK}" > do_fetch[file-checksums] = "" > do_fetch[vardeps] = "" > > +python do_unpack() { > + import shutil > + shutil.copyfile(d.getVar("CVE_CHECK_DB_DLDIR_FILE"), d.getVar("CVE_CHECK_DB_FILE")) > +} > +do_unpack[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK} ${CVE_CHECK_DB_FILE_LOCK}" > + > def cleanup_db_download(db_file, db_tmp_file): > """ > Cleanup the download space from possible failed downloads > -- > 2.34.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#206820): https://lists.openembedded.org/g/openembedded-core/message/206820 > Mute This Topic: https://lists.openembedded.org/mt/109438548/3616779 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [vincent.prince.fr@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > ^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-11-26 13:02 ` Vincent Prince @ 2024-11-26 13:18 ` Yoann Congal 2024-11-28 15:58 ` Yoann Congal 2024-11-28 16:08 ` Marta Rybczynska 1 sibling, 1 reply; 25+ messages in thread From: Yoann Congal @ 2024-11-26 13:18 UTC (permalink / raw) To: vincent.prince.fr; +Cc: steve, openembedded-core [-- Attachment #1: Type: text/plain, Size: 6078 bytes --] Le mar. 26 nov. 2024 à 14:02, Vincent Prince via lists.openembedded.org < vincent.prince.fr=gmail.com@lists.openembedded.org> a écrit : > Hello, > > I'm wondering if I'm the only one who couldn't complete do_fetch of > cve-update-nvd2-native with maximum retries on CVE API? > I tried with or without API Key, from several different machines, I > also tried to increase retries number etc, without success. > I did a successful full download with a crazy retry number (100). It took a long time but it finished eventually. You can monitor the progress with bitbake cve-update-nvd2-native -c fetch -v > I see on the NVD status page the following warning : > "Due to changes described below, a large number of CVE records have > recently been updated, resulting in a large increase in API requests. > We are aware of the issue and are working to mitigate it. Thank you > for your patience." > Thanks for the update, I did not think of checking the website -_-' > I see the Buildroot switched from NVD to alternative FKIE github > database due to that API 2.0 inconsistency :/ > https://github.com/fkie-cad/nvd-json-data-feeds If the situation at NVD does not change we might have to also switch I'm not sure what are my options here, quite odd that cybersecurity > organisation get impacted by DDoS :D > > Best regards, > Vincent > > Le jeu. 7 nov. 2024 à 04:38, Steve Sakoman via lists.openembedded.org > <steve=sakoman.com@lists.openembedded.org> a écrit : > > > > From: Richard Purdie <richard.purdie@linuxfoundation.org> > > > > Rtaher than trying to use a sqlite database over NFS from DL_DIR, work > from > > a local copy in STAGING DIR after fetching. > > > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> > > (cherry picked from commit 03596904392d257572a905a182b92c780d636744) > > Signed-off-by: Steve Sakoman <steve@sakoman.com> > > --- > > meta/classes/cve-check.bbclass | 7 ++++--- > > .../meta/cve-update-nvd2-native.bb | 18 +++++++++++++----- > > 2 files changed, 17 insertions(+), 8 deletions(-) > > > > diff --git a/meta/classes/cve-check.bbclass > b/meta/classes/cve-check.bbclass > > index d287cf1457..ed219bf472 100644 > > --- a/meta/classes/cve-check.bbclass > > +++ b/meta/classes/cve-check.bbclass > > @@ -31,8 +31,9 @@ > > CVE_PRODUCT ??= "${BPN}" > > CVE_VERSION ??= "${PV}" > > > > -CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" > > -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2-2.db" > > +CVE_CHECK_DB_FILENAME ?= "nvdcve_2-2.db" > > +CVE_CHECK_DB_DIR ?= "${STAGING_DIR}/CVE_CHECK" > > +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/${CVE_CHECK_DB_FILENAME}" > > CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" > > > > CVE_CHECK_LOG ?= "${T}/cve.log" > > @@ -198,7 +199,7 @@ python do_cve_check () { > > } > > > > addtask cve_check before do_build > > -do_cve_check[depends] = "cve-update-nvd2-native:do_fetch" > > +do_cve_check[depends] = "cve-update-nvd2-native:do_unpack" > > do_cve_check[nostamp] = "1" > > > > python cve_check_cleanup () { > > diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb > b/meta/recipes-core/meta/cve-update-nvd2-native.bb > > index 92177712dc..5fbe9095cc 100644 > > --- a/meta/recipes-core/meta/cve-update-nvd2-native.bb > > +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb > > @@ -8,7 +8,6 @@ INHIBIT_DEFAULT_DEPS = "1" > > > > inherit native > > > > -deltask do_unpack > > deltask do_patch > > deltask do_configure > > deltask do_compile > > @@ -35,7 +34,9 @@ CVE_DB_INCR_UPDATE_AGE_THRES ?= "10368000" > > # Number of attempts for each http query to nvd server before giving up > > CVE_DB_UPDATE_ATTEMPTS ?= "5" > > > > -CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_2.db" > > +CVE_CHECK_DB_DLDIR_FILE ?= > "${DL_DIR}/CVE_CHECK/${CVE_CHECK_DB_FILENAME}" > > +CVE_CHECK_DB_DLDIR_LOCK ?= "${CVE_CHECK_DB_DLDIR_FILE}.lock" > > +CVE_CHECK_DB_TEMP_FILE ?= "${CVE_CHECK_DB_FILE}.tmp" > > > > python () { > > if not bb.data.inherits_class("cve-check", d): > > @@ -52,9 +53,9 @@ python do_fetch() { > > > > bb.utils.export_proxies(d) > > > > - db_file = d.getVar("CVE_CHECK_DB_FILE") > > + db_file = d.getVar("CVE_CHECK_DB_DLDIR_FILE") > > db_dir = os.path.dirname(db_file) > > - db_tmp_file = d.getVar("CVE_DB_TEMP_FILE") > > + db_tmp_file = d.getVar("CVE_CHECK_DB_TEMP_FILE") > > > > cleanup_db_download(db_file, db_tmp_file) > > # By default let's update the whole database (since time 0) > > @@ -77,6 +78,7 @@ python do_fetch() { > > pass > > > > bb.utils.mkdirhier(db_dir) > > + bb.utils.mkdirhier(os.path.dirname(db_tmp_file)) > > if os.path.exists(db_file): > > shutil.copy2(db_file, db_tmp_file) > > > > @@ -89,10 +91,16 @@ python do_fetch() { > > os.remove(db_tmp_file) > > } > > > > -do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}" > > +do_fetch[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK}" > > do_fetch[file-checksums] = "" > > do_fetch[vardeps] = "" > > > > +python do_unpack() { > > + import shutil > > + shutil.copyfile(d.getVar("CVE_CHECK_DB_DLDIR_FILE"), > d.getVar("CVE_CHECK_DB_FILE")) > > +} > > +do_unpack[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK} > ${CVE_CHECK_DB_FILE_LOCK}" > > + > > def cleanup_db_download(db_file, db_tmp_file): > > """ > > Cleanup the download space from possible failed downloads > > -- > > 2.34.1 > > > > > > > > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#207851): > https://lists.openembedded.org/g/openembedded-core/message/207851 > Mute This Topic: https://lists.openembedded.org/mt/109438548/4316185 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ > yoann.congal@smile.fr] > -=-=-=-=-=-=-=-=-=-=-=- > > -- Yoann Congal Smile ECS - Tech expert [-- Attachment #2: Type: text/html, Size: 9590 bytes --] ^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-11-26 13:18 ` Yoann Congal @ 2024-11-28 15:58 ` Yoann Congal 0 siblings, 0 replies; 25+ messages in thread From: Yoann Congal @ 2024-11-28 15:58 UTC (permalink / raw) To: vincent.prince.fr; +Cc: steve, openembedded-core [-- Attachment #1: Type: text/plain, Size: 6504 bytes --] Le mar. 26 nov. 2024 à 14:18, Yoann Congal <yoann.congal@smile.fr> a écrit : > > > Le mar. 26 nov. 2024 à 14:02, Vincent Prince via lists.openembedded.org < > vincent.prince.fr=gmail.com@lists.openembedded.org> a écrit : > >> Hello, >> >> I'm wondering if I'm the only one who couldn't complete do_fetch of >> cve-update-nvd2-native with maximum retries on CVE API? >> I tried with or without API Key, from several different machines, I >> also tried to increase retries number etc, without success. >> > > I did a successful full download with a crazy retry number (100). It took > a long time but it finished eventually. > > You can monitor the progress with > bitbake cve-update-nvd2-native -c fetch -v > > > >> I see on the NVD status page the following warning : >> "Due to changes described below, a large number of CVE records have >> recently been updated, resulting in a large increase in API requests. >> We are aware of the issue and are working to mitigate it. Thank you >> for your patience." >> > > Thanks for the update, I did not think of checking the website -_-' > > >> I see the Buildroot switched from NVD to alternative FKIE github >> database due to that API 2.0 inconsistency :/ >> > > https://github.com/fkie-cad/nvd-json-data-feeds > > If the situation at NVD does not change we might have to also switch > > I'm not sure what are my options here, quite odd that cybersecurity >> organisation get impacted by DDoS :D >> > This is now tracked in the bugzilla : https://bugzilla.yoctoproject.org/show_bug.cgi?id=15660 > Best regards, >> Vincent >> >> Le jeu. 7 nov. 2024 à 04:38, Steve Sakoman via lists.openembedded.org >> <steve=sakoman.com@lists.openembedded.org> a écrit : >> > >> > From: Richard Purdie <richard.purdie@linuxfoundation.org> >> > >> > Rtaher than trying to use a sqlite database over NFS from DL_DIR, work >> from >> > a local copy in STAGING DIR after fetching. >> > >> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> >> > (cherry picked from commit 03596904392d257572a905a182b92c780d636744) >> > Signed-off-by: Steve Sakoman <steve@sakoman.com> >> > --- >> > meta/classes/cve-check.bbclass | 7 ++++--- >> > .../meta/cve-update-nvd2-native.bb | 18 +++++++++++++----- >> > 2 files changed, 17 insertions(+), 8 deletions(-) >> > >> > diff --git a/meta/classes/cve-check.bbclass >> b/meta/classes/cve-check.bbclass >> > index d287cf1457..ed219bf472 100644 >> > --- a/meta/classes/cve-check.bbclass >> > +++ b/meta/classes/cve-check.bbclass >> > @@ -31,8 +31,9 @@ >> > CVE_PRODUCT ??= "${BPN}" >> > CVE_VERSION ??= "${PV}" >> > >> > -CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" >> > -CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvdcve_2-2.db" >> > +CVE_CHECK_DB_FILENAME ?= "nvdcve_2-2.db" >> > +CVE_CHECK_DB_DIR ?= "${STAGING_DIR}/CVE_CHECK" >> > +CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/${CVE_CHECK_DB_FILENAME}" >> > CVE_CHECK_DB_FILE_LOCK ?= "${CVE_CHECK_DB_FILE}.lock" >> > >> > CVE_CHECK_LOG ?= "${T}/cve.log" >> > @@ -198,7 +199,7 @@ python do_cve_check () { >> > } >> > >> > addtask cve_check before do_build >> > -do_cve_check[depends] = "cve-update-nvd2-native:do_fetch" >> > +do_cve_check[depends] = "cve-update-nvd2-native:do_unpack" >> > do_cve_check[nostamp] = "1" >> > >> > python cve_check_cleanup () { >> > diff --git a/meta/recipes-core/meta/cve-update-nvd2-native.bb >> b/meta/recipes-core/meta/cve-update-nvd2-native.bb >> > index 92177712dc..5fbe9095cc 100644 >> > --- a/meta/recipes-core/meta/cve-update-nvd2-native.bb >> > +++ b/meta/recipes-core/meta/cve-update-nvd2-native.bb >> > @@ -8,7 +8,6 @@ INHIBIT_DEFAULT_DEPS = "1" >> > >> > inherit native >> > >> > -deltask do_unpack >> > deltask do_patch >> > deltask do_configure >> > deltask do_compile >> > @@ -35,7 +34,9 @@ CVE_DB_INCR_UPDATE_AGE_THRES ?= "10368000" >> > # Number of attempts for each http query to nvd server before giving up >> > CVE_DB_UPDATE_ATTEMPTS ?= "5" >> > >> > -CVE_DB_TEMP_FILE ?= "${CVE_CHECK_DB_DIR}/temp_nvdcve_2.db" >> > +CVE_CHECK_DB_DLDIR_FILE ?= >> "${DL_DIR}/CVE_CHECK/${CVE_CHECK_DB_FILENAME}" >> > +CVE_CHECK_DB_DLDIR_LOCK ?= "${CVE_CHECK_DB_DLDIR_FILE}.lock" >> > +CVE_CHECK_DB_TEMP_FILE ?= "${CVE_CHECK_DB_FILE}.tmp" >> > >> > python () { >> > if not bb.data.inherits_class("cve-check", d): >> > @@ -52,9 +53,9 @@ python do_fetch() { >> > >> > bb.utils.export_proxies(d) >> > >> > - db_file = d.getVar("CVE_CHECK_DB_FILE") >> > + db_file = d.getVar("CVE_CHECK_DB_DLDIR_FILE") >> > db_dir = os.path.dirname(db_file) >> > - db_tmp_file = d.getVar("CVE_DB_TEMP_FILE") >> > + db_tmp_file = d.getVar("CVE_CHECK_DB_TEMP_FILE") >> > >> > cleanup_db_download(db_file, db_tmp_file) >> > # By default let's update the whole database (since time 0) >> > @@ -77,6 +78,7 @@ python do_fetch() { >> > pass >> > >> > bb.utils.mkdirhier(db_dir) >> > + bb.utils.mkdirhier(os.path.dirname(db_tmp_file)) >> > if os.path.exists(db_file): >> > shutil.copy2(db_file, db_tmp_file) >> > >> > @@ -89,10 +91,16 @@ python do_fetch() { >> > os.remove(db_tmp_file) >> > } >> > >> > -do_fetch[lockfiles] += "${CVE_CHECK_DB_FILE_LOCK}" >> > +do_fetch[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK}" >> > do_fetch[file-checksums] = "" >> > do_fetch[vardeps] = "" >> > >> > +python do_unpack() { >> > + import shutil >> > + shutil.copyfile(d.getVar("CVE_CHECK_DB_DLDIR_FILE"), >> d.getVar("CVE_CHECK_DB_FILE")) >> > +} >> > +do_unpack[lockfiles] += "${CVE_CHECK_DB_DLDIR_LOCK} >> ${CVE_CHECK_DB_FILE_LOCK}" >> > + >> > def cleanup_db_download(db_file, db_tmp_file): >> > """ >> > Cleanup the download space from possible failed downloads >> > -- >> > 2.34.1 >> > >> > >> > >> > >> >> -=-=-=-=-=-=-=-=-=-=-=- >> Links: You receive all messages sent to this group. >> View/Reply Online (#207851): >> https://lists.openembedded.org/g/openembedded-core/message/207851 >> Mute This Topic: https://lists.openembedded.org/mt/109438548/4316185 >> Group Owner: openembedded-core+owner@lists.openembedded.org >> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ >> yoann.congal@smile.fr] >> -=-=-=-=-=-=-=-=-=-=-=- >> >> > > -- > Yoann Congal > Smile ECS - Tech expert > -- Yoann Congal Smile ECS - Tech expert [-- Attachment #2: Type: text/html, Size: 10833 bytes --] ^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-11-26 13:02 ` Vincent Prince 2024-11-26 13:18 ` Yoann Congal @ 2024-11-28 16:08 ` Marta Rybczynska 2024-12-01 13:40 ` Yoann Congal 1 sibling, 1 reply; 25+ messages in thread From: Marta Rybczynska @ 2024-11-28 16:08 UTC (permalink / raw) To: vincent.prince.fr; +Cc: steve, openembedded-core [-- Attachment #1: Type: text/plain, Size: 1106 bytes --] On Tue, Nov 26, 2024 at 2:05 PM Vincent Prince via lists.openembedded.org < vincent.prince.fr=gmail.com@lists.openembedded.org> wrote: > Hello, > > I'm wondering if I'm the only one who couldn't complete do_fetch of > cve-update-nvd2-native with maximum retries on CVE API? > I tried with or without API Key, from several different machines, I > also tried to increase retries number etc, without success. > > I see on the NVD status page the following warning : > "Due to changes described below, a large number of CVE records have > recently been updated, resulting in a large increase in API requests. > We are aware of the issue and are working to mitigate it. Thank you > for your patience." > > I see the Buildroot switched from NVD to alternative FKIE github > database due to that API 2.0 inconsistency :/ > > I'm not sure what are my options here, quite odd that cybersecurity > organisation get impacted by DDoS :D > If it doesn't improve in a reasonable time (like until the end of the week) I'm for mirroring it. The complete image for now. Kind regards, Marta [-- Attachment #2: Type: text/html, Size: 1624 bytes --] ^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-11-28 16:08 ` Marta Rybczynska @ 2024-12-01 13:40 ` Yoann Congal 2024-12-01 16:34 ` Marta Rybczynska 0 siblings, 1 reply; 25+ messages in thread From: Yoann Congal @ 2024-12-01 13:40 UTC (permalink / raw) To: rybczynska; +Cc: vincent.prince.fr, steve, openembedded-core [-- Attachment #1: Type: text/plain, Size: 1942 bytes --] Le jeu. 28 nov. 2024 à 17:09, Marta Rybczynska via lists.openembedded.org <rybczynska=gmail.com@lists.openembedded.org> a écrit : > On Tue, Nov 26, 2024 at 2:05 PM Vincent Prince via lists.openembedded.org > <vincent.prince.fr=gmail.com@lists.openembedded.org> wrote: > >> Hello, >> >> I'm wondering if I'm the only one who couldn't complete do_fetch of >> cve-update-nvd2-native with maximum retries on CVE API? >> I tried with or without API Key, from several different machines, I >> also tried to increase retries number etc, without success. >> >> I see on the NVD status page the following warning : >> "Due to changes described below, a large number of CVE records have >> recently been updated, resulting in a large increase in API requests. >> We are aware of the issue and are working to mitigate it. Thank you >> for your patience." >> >> I see the Buildroot switched from NVD to alternative FKIE github >> database due to that API 2.0 inconsistency :/ >> >> I'm not sure what are my options here, quite odd that cybersecurity >> organisation get impacted by DDoS :D >> > > If it doesn't improve in a reasonable time (like until the end of the > week) I'm for mirroring it. The complete image for now. > FYI, this looks like it's fixed now : https://valkyrie.yoctoproject.org/#/builders/103 has been green for 2 days and, locally, no HTTP errors. Regards, Kind regards, > Marta > > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#207995): > https://lists.openembedded.org/g/openembedded-core/message/207995 > Mute This Topic: https://lists.openembedded.org/mt/109438548/4316185 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ > yoann.congal@smile.fr] > -=-=-=-=-=-=-=-=-=-=-=- > > -- Yoann Congal Smile ECS - Tech expert [-- Attachment #2: Type: text/html, Size: 3850 bytes --] ^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds 2024-12-01 13:40 ` Yoann Congal @ 2024-12-01 16:34 ` Marta Rybczynska 0 siblings, 0 replies; 25+ messages in thread From: Marta Rybczynska @ 2024-12-01 16:34 UTC (permalink / raw) To: Yoann Congal; +Cc: vincent.prince.fr, steve, openembedded-core [-- Attachment #1: Type: text/plain, Size: 1799 bytes --] On Sun, Dec 1, 2024 at 2:40 PM Yoann Congal <yoann.congal@smile.fr> wrote: > > > Le jeu. 28 nov. 2024 à 17:09, Marta Rybczynska via lists.openembedded.org > <rybczynska=gmail.com@lists.openembedded.org> a écrit : > >> On Tue, Nov 26, 2024 at 2:05 PM Vincent Prince via lists.openembedded.org >> <vincent.prince.fr=gmail.com@lists.openembedded.org> wrote: >> >>> Hello, >>> >>> I'm wondering if I'm the only one who couldn't complete do_fetch of >>> cve-update-nvd2-native with maximum retries on CVE API? >>> I tried with or without API Key, from several different machines, I >>> also tried to increase retries number etc, without success. >>> >>> I see on the NVD status page the following warning : >>> "Due to changes described below, a large number of CVE records have >>> recently been updated, resulting in a large increase in API requests. >>> We are aware of the issue and are working to mitigate it. Thank you >>> for your patience." >>> >>> I see the Buildroot switched from NVD to alternative FKIE github >>> database due to that API 2.0 inconsistency :/ >>> >>> I'm not sure what are my options here, quite odd that cybersecurity >>> organisation get impacted by DDoS :D >>> >> >> If it doesn't improve in a reasonable time (like until the end of the >> week) I'm for mirroring it. The complete image for now. >> > > FYI, this looks like it's fixed now : > https://valkyrie.yoctoproject.org/#/builders/103 has been green for 2 > days and, locally, no HTTP errors. > > For info, I have a partially working switch to a different source. It isn't complicated, just a question of applying recent modifications to the other fetcher. I will post an RFC so that we do have an alternative the next time it goes down. Kind regards, Marta [-- Attachment #2: Type: text/html, Size: 3149 bytes --] ^ permalink raw reply [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 03/10] rust-llvm: Fix CVE-2024-0151 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 01/10] cve-check: add support for cvss v4.0 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 04/10] orc: upgrade 0.4.39 -> 0.4.40 Steve Sakoman ` (6 subsequent siblings) 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../0004-llvm-Fix-CVE-2024-0151.patch | 1086 +++++++++++++++++ .../recipes-devtools/rust/rust-llvm_1.75.0.bb | 3 +- 2 files changed, 1088 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch diff --git a/meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch b/meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch new file mode 100644 index 0000000000..c05685e64d --- /dev/null +++ b/meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch @@ -0,0 +1,1086 @@ +commit 78ff617d3f573fb3a9b2fef180fa0fd43d5584ea +Author: Lucas Duarte Prates <lucas.prates@arm.com> +Date: Thu Jun 20 10:22:01 2024 +0100 + + [ARM] CMSE security mitigation on function arguments and returned values (#89944) + + The ABI mandates two things related to function calls: + - Function arguments must be sign- or zero-extended to the register + size by the caller. + - Return values must be sign- or zero-extended to the register size by + the callee. + + As consequence, callees can assume that function arguments have been + extended and so can callers with regards to return values. + + Here lies the problem: Nonsecure code might deliberately ignore this + mandate with the intent of attempting an exploit. It might try to pass + values that lie outside the expected type's value range in order to + trigger undefined behaviour, e.g. out of bounds access. + + With the mitigation implemented, Secure code always performs extension + of values passed by Nonsecure code. + + This addresses the vulnerability described in CVE-2024-0151. + + Patches by Victor Campos. + + --------- + + Co-authored-by: Victor Campos <victor.campos@arm.com> + +Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/78ff617d3f573fb3a9b2fef180fa0fd43d5584ea] +CVE: CVE-2024-0151 +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> +--- +diff --git a/llvm/lib/Target/ARM/ARMISelLowering.cpp b/llvm/lib/Target/ARM/ARMISelLowering.cpp +index bfe137b95602..5490c3c9df6c 100644 +--- a/llvm/lib/Target/ARM/ARMISelLowering.cpp ++++ b/llvm/lib/Target/ARM/ARMISelLowering.cpp +@@ -156,6 +156,17 @@ static const MCPhysReg GPRArgRegs[] = { + ARM::R0, ARM::R1, ARM::R2, ARM::R3 + }; + ++static SDValue handleCMSEValue(const SDValue &Value, const ISD::InputArg &Arg, ++ SelectionDAG &DAG, const SDLoc &DL) { ++ assert(Arg.ArgVT.isScalarInteger()); ++ assert(Arg.ArgVT.bitsLT(MVT::i32)); ++ SDValue Trunc = DAG.getNode(ISD::TRUNCATE, DL, Arg.ArgVT, Value); ++ SDValue Ext = ++ DAG.getNode(Arg.Flags.isSExt() ? ISD::SIGN_EXTEND : ISD::ZERO_EXTEND, DL, ++ MVT::i32, Trunc); ++ return Ext; ++} ++ + void ARMTargetLowering::addTypeForNEON(MVT VT, MVT PromotedLdStVT) { + if (VT != PromotedLdStVT) { + setOperationAction(ISD::LOAD, VT, Promote); +@@ -2196,7 +2207,7 @@ SDValue ARMTargetLowering::LowerCallResult( + SDValue Chain, SDValue InGlue, CallingConv::ID CallConv, bool isVarArg, + const SmallVectorImpl<ISD::InputArg> &Ins, const SDLoc &dl, + SelectionDAG &DAG, SmallVectorImpl<SDValue> &InVals, bool isThisReturn, +- SDValue ThisVal) const { ++ SDValue ThisVal, bool isCmseNSCall) const { + // Assign locations to each value returned by this call. + SmallVector<CCValAssign, 16> RVLocs; + CCState CCInfo(CallConv, isVarArg, DAG.getMachineFunction(), RVLocs, +@@ -2274,6 +2285,15 @@ SDValue ARMTargetLowering::LowerCallResult( + (VA.getValVT() == MVT::f16 || VA.getValVT() == MVT::bf16)) + Val = MoveToHPR(dl, DAG, VA.getLocVT(), VA.getValVT(), Val); + ++ // On CMSE Non-secure Calls, call results (returned values) whose bitwidth ++ // is less than 32 bits must be sign- or zero-extended after the call for ++ // security reasons. Although the ABI mandates an extension done by the ++ // callee, the latter cannot be trusted to follow the rules of the ABI. ++ const ISD::InputArg &Arg = Ins[VA.getValNo()]; ++ if (isCmseNSCall && Arg.ArgVT.isScalarInteger() && ++ VA.getLocVT().isScalarInteger() && Arg.ArgVT.bitsLT(MVT::i32)) ++ Val = handleCMSEValue(Val, Arg, DAG, dl); ++ + InVals.push_back(Val); + } + +@@ -2888,7 +2908,7 @@ ARMTargetLowering::LowerCall(TargetLowering::CallLoweringInfo &CLI, + // return. + return LowerCallResult(Chain, InGlue, CallConv, isVarArg, Ins, dl, DAG, + InVals, isThisReturn, +- isThisReturn ? OutVals[0] : SDValue()); ++ isThisReturn ? OutVals[0] : SDValue(), isCmseNSCall); + } + + /// HandleByVal - Every parameter *after* a byval parameter is passed +@@ -4485,8 +4505,6 @@ SDValue ARMTargetLowering::LowerFormalArguments( + *DAG.getContext()); + CCInfo.AnalyzeFormalArguments(Ins, CCAssignFnForCall(CallConv, isVarArg)); + +- SmallVector<SDValue, 16> ArgValues; +- SDValue ArgValue; + Function::const_arg_iterator CurOrigArg = MF.getFunction().arg_begin(); + unsigned CurArgIdx = 0; + +@@ -4541,6 +4559,7 @@ SDValue ARMTargetLowering::LowerFormalArguments( + // Arguments stored in registers. + if (VA.isRegLoc()) { + EVT RegVT = VA.getLocVT(); ++ SDValue ArgValue; + + if (VA.needsCustom() && VA.getLocVT() == MVT::v2f64) { + // f64 and vector types are split up into multiple registers or +@@ -4604,16 +4623,6 @@ SDValue ARMTargetLowering::LowerFormalArguments( + case CCValAssign::BCvt: + ArgValue = DAG.getNode(ISD::BITCAST, dl, VA.getValVT(), ArgValue); + break; +- case CCValAssign::SExt: +- ArgValue = DAG.getNode(ISD::AssertSext, dl, RegVT, ArgValue, +- DAG.getValueType(VA.getValVT())); +- ArgValue = DAG.getNode(ISD::TRUNCATE, dl, VA.getValVT(), ArgValue); +- break; +- case CCValAssign::ZExt: +- ArgValue = DAG.getNode(ISD::AssertZext, dl, RegVT, ArgValue, +- DAG.getValueType(VA.getValVT())); +- ArgValue = DAG.getNode(ISD::TRUNCATE, dl, VA.getValVT(), ArgValue); +- break; + } + + // f16 arguments have their size extended to 4 bytes and passed as if they +@@ -4623,6 +4632,15 @@ SDValue ARMTargetLowering::LowerFormalArguments( + (VA.getValVT() == MVT::f16 || VA.getValVT() == MVT::bf16)) + ArgValue = MoveToHPR(dl, DAG, VA.getLocVT(), VA.getValVT(), ArgValue); + ++ // On CMSE Entry Functions, formal integer arguments whose bitwidth is ++ // less than 32 bits must be sign- or zero-extended in the callee for ++ // security reasons. Although the ABI mandates an extension done by the ++ // caller, the latter cannot be trusted to follow the rules of the ABI. ++ const ISD::InputArg &Arg = Ins[VA.getValNo()]; ++ if (AFI->isCmseNSEntryFunction() && Arg.ArgVT.isScalarInteger() && ++ RegVT.isScalarInteger() && Arg.ArgVT.bitsLT(MVT::i32)) ++ ArgValue = handleCMSEValue(ArgValue, Arg, DAG, dl); ++ + InVals.push_back(ArgValue); + } else { // VA.isRegLoc() + // Only arguments passed on the stack should make it here. +diff --git a/llvm/lib/Target/ARM/ARMISelLowering.h b/llvm/lib/Target/ARM/ARMISelLowering.h +index 62a52bdb03f7..a255e9b6fc36 100644 +--- a/llvm/lib/Target/ARM/ARMISelLowering.h ++++ b/llvm/lib/Target/ARM/ARMISelLowering.h +@@ -891,7 +891,7 @@ class VectorType; + const SmallVectorImpl<ISD::InputArg> &Ins, + const SDLoc &dl, SelectionDAG &DAG, + SmallVectorImpl<SDValue> &InVals, bool isThisReturn, +- SDValue ThisVal) const; ++ SDValue ThisVal, bool isCmseNSCall) const; + + bool supportSplitCSR(MachineFunction *MF) const override { + return MF->getFunction().getCallingConv() == CallingConv::CXX_FAST_TLS && +diff --git a/llvm/test/CodeGen/ARM/cmse-harden-call-returned-values.ll b/llvm/test/CodeGen/ARM/cmse-harden-call-returned-values.ll +new file mode 100644 +index 0000000000..58eef443c25e +--- /dev/null ++++ b/llvm/test/CodeGen/ARM/cmse-harden-call-returned-values.ll +@@ -0,0 +1,552 @@ ++; RUN: llc %s -mtriple=thumbv8m.main -o - | FileCheck %s --check-prefixes V8M-COMMON,V8M-LE ++; RUN: llc %s -mtriple=thumbebv8m.main -o - | FileCheck %s --check-prefixes V8M-COMMON,V8M-BE ++; RUN: llc %s -mtriple=thumbv8.1m.main -o - | FileCheck %s --check-prefixes V81M-COMMON,V81M-LE ++; RUN: llc %s -mtriple=thumbebv8.1m.main -o - | FileCheck %s --check-prefixes V81M-COMMON,V81M-BE ++ ++@get_idx = hidden local_unnamed_addr global ptr null, align 4 ++@arr = hidden local_unnamed_addr global [256 x i32] zeroinitializer, align 4 ++ ++define i32 @access_i16() { ++; V8M-COMMON-LABEL: access_i16: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: sxth r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_i16: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: sxth r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call signext i16 %0() "cmse_nonsecure_call" ++ %idxprom = sext i16 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_u16() { ++; V8M-COMMON-LABEL: access_u16: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: uxth r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_u16: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: uxth r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call zeroext i16 %0() "cmse_nonsecure_call" ++ %idxprom = zext i16 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_i8() { ++; V8M-COMMON-LABEL: access_i8: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: sxtb r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_i8: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: sxtb r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call signext i8 %0() "cmse_nonsecure_call" ++ %idxprom = sext i8 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_u8() { ++; V8M-COMMON-LABEL: access_u8: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: uxtb r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_u8: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: uxtb r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call zeroext i8 %0() "cmse_nonsecure_call" ++ %idxprom = zext i8 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_i1() { ++; V8M-COMMON-LABEL: access_i1: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_i1: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call zeroext i1 %0() "cmse_nonsecure_call" ++ %idxprom = zext i1 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_i5() { ++; V8M-COMMON-LABEL: access_i5: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: sbfx r0, r0, #0, #5 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_i5: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: sbfx r0, r0, #0, #5 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call signext i5 %0() "cmse_nonsecure_call" ++ %idxprom = sext i5 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_u5() { ++; V8M-COMMON-LABEL: access_u5: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V8M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V8M-COMMON-NEXT: ldr r0, [r0] ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: and r0, r0, #31 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_u5: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: movw r0, :lower16:get_idx ++; V81M-COMMON-NEXT: movt r0, :upper16:get_idx ++; V81M-COMMON-NEXT: ldr r0, [r0] ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: and r0, r0, #31 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %0 = load ptr, ptr @get_idx, align 4 ++ %call = tail call zeroext i5 %0() "cmse_nonsecure_call" ++ %idxprom = zext i5 %call to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %1 = load i32, ptr %arrayidx, align 4 ++ ret i32 %1 ++} ++ ++define i32 @access_i33(ptr %f) { ++; V8M-COMMON-LABEL: access_i33: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-LE-NEXT: and r0, r1, #1 ++; V8M-BE-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: rsb.w r0, r0, #0 ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_i33: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-LE-NEXT: and r0, r1, #1 ++; V81M-BE-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: rsb.w r0, r0, #0 ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %call = tail call i33 %f() "cmse_nonsecure_call" ++ %shr = ashr i33 %call, 32 ++ %conv = trunc nsw i33 %shr to i32 ++ ret i32 %conv ++} ++ ++define i32 @access_u33(ptr %f) { ++; V8M-COMMON-LABEL: access_u33: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: push {r7, lr} ++; V8M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-COMMON-NEXT: bic r0, r0, #1 ++; V8M-COMMON-NEXT: sub sp, #136 ++; V8M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V8M-COMMON-NEXT: mov r1, r0 ++; V8M-COMMON-NEXT: mov r2, r0 ++; V8M-COMMON-NEXT: mov r3, r0 ++; V8M-COMMON-NEXT: mov r4, r0 ++; V8M-COMMON-NEXT: mov r5, r0 ++; V8M-COMMON-NEXT: mov r6, r0 ++; V8M-COMMON-NEXT: mov r7, r0 ++; V8M-COMMON-NEXT: mov r8, r0 ++; V8M-COMMON-NEXT: mov r9, r0 ++; V8M-COMMON-NEXT: mov r10, r0 ++; V8M-COMMON-NEXT: mov r11, r0 ++; V8M-COMMON-NEXT: mov r12, r0 ++; V8M-COMMON-NEXT: msr apsr_nzcvq, r0 ++; V8M-COMMON-NEXT: blxns r0 ++; V8M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V8M-COMMON-NEXT: add sp, #136 ++; V8M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V8M-LE-NEXT: and r0, r1, #1 ++; V8M-BE-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: pop {r7, pc} ++; ++; V81M-COMMON-LABEL: access_u33: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: push {r7, lr} ++; V81M-COMMON-NEXT: push.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-COMMON-NEXT: bic r0, r0, #1 ++; V81M-COMMON-NEXT: sub sp, #136 ++; V81M-COMMON-NEXT: vlstm sp, {d0 - d15} ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, apsr} ++; V81M-COMMON-NEXT: blxns r0 ++; V81M-COMMON-NEXT: vlldm sp, {d0 - d15} ++; V81M-COMMON-NEXT: add sp, #136 ++; V81M-COMMON-NEXT: pop.w {r4, r5, r6, r7, r8, r9, r10, r11} ++; V81M-LE-NEXT: and r0, r1, #1 ++; V81M-BE-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: pop {r7, pc} ++entry: ++ %call = tail call i33 %f() "cmse_nonsecure_call" ++ %shr = lshr i33 %call, 32 ++ %conv = trunc nuw nsw i33 %shr to i32 ++ ret i32 %conv ++} +diff --git a/llvm/test/CodeGen/ARM/cmse-harden-entry-arguments.ll b/llvm/test/CodeGen/ARM/cmse-harden-entry-arguments.ll +new file mode 100644 +index 0000000000..c66ab00566dd +--- /dev/null ++++ b/llvm/test/CodeGen/ARM/cmse-harden-entry-arguments.ll +@@ -0,0 +1,368 @@ ++; RUN: llc %s -mtriple=thumbv8m.main -o - | FileCheck %s --check-prefixes V8M-COMMON,V8M-LE ++; RUN: llc %s -mtriple=thumbebv8m.main -o - | FileCheck %s --check-prefixes V8M-COMMON,V8M-BE ++; RUN: llc %s -mtriple=thumbv8.1m.main -o - | FileCheck %s --check-prefixes V81M-COMMON,V81M-LE ++; RUN: llc %s -mtriple=thumbebv8.1m.main -o - | FileCheck %s --check-prefixes V81M-COMMON,V81M-BE ++ ++@arr = hidden local_unnamed_addr global [256 x i32] zeroinitializer, align 4 ++ ++define i32 @access_i16(i16 signext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_i16: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: sxth r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_i16: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: sxth r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = sext i16 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_u16(i16 zeroext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_u16: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: uxth r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_u16: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: uxth r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = zext i16 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_i8(i8 signext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_i8: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: sxtb r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_i8: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: sxtb r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = sext i8 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_u8(i8 zeroext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_u8: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: uxtb r0, r0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_u8: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: uxtb r0, r0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = zext i8 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_i1(i1 signext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_i1: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: rsbs r0, r0, #0 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_i1: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: rsbs r0, r0, #0 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = zext i1 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_i5(i5 signext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_i5: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: sbfx r0, r0, #0, #5 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_i5: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: sbfx r0, r0, #0, #5 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = sext i5 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_u5(i5 zeroext %idx) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_u5: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: movw r1, :lower16:arr ++; V8M-COMMON-NEXT: and r0, r0, #31 ++; V8M-COMMON-NEXT: movt r1, :upper16:arr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_u5: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: movw r1, :lower16:arr ++; V81M-COMMON-NEXT: and r0, r0, #31 ++; V81M-COMMON-NEXT: movt r1, :upper16:arr ++; V81M-COMMON-NEXT: ldr.w r0, [r1, r0, lsl #2] ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %idxprom = zext i5 %idx to i32 ++ %arrayidx = getelementptr inbounds [256 x i32], ptr @arr, i32 0, i32 %idxprom ++ %0 = load i32, ptr %arrayidx, align 4 ++ ret i32 %0 ++} ++ ++define i32 @access_i33(i33 %arg) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_i33: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-LE-NEXT: and r0, r1, #1 ++; V8M-BE-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: rsbs r0, r0, #0 ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_i33: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-LE-NEXT: and r0, r1, #1 ++; V81M-BE-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: rsbs r0, r0, #0 ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %shr = ashr i33 %arg, 32 ++ %conv = trunc nsw i33 %shr to i32 ++ ret i32 %conv ++} ++ ++define i32 @access_u33(i33 %arg) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_u33: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-LE-NEXT: and r0, r1, #1 ++; V8M-BE-NEXT: and r0, r0, #1 ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_u33: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-LE-NEXT: and r0, r1, #1 ++; V81M-BE-NEXT: and r0, r0, #1 ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %shr = lshr i33 %arg, 32 ++ %conv = trunc nuw nsw i33 %shr to i32 ++ ret i32 %conv ++} ++ ++define i32 @access_i65(ptr byval(i65) %0) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_i65: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: sub sp, #16 ++; V8M-COMMON-NEXT: stm.w sp, {r0, r1, r2, r3} ++; V8M-LE-NEXT: ldrb.w r0, [sp, #8] ++; V8M-LE-NEXT: and r0, r0, #1 ++; V8M-LE-NEXT: rsbs r0, r0, #0 ++; V8M-BE-NEXT: movs r1, #0 ++; V8M-BE-NEXT: sub.w r0, r1, r0, lsr #24 ++; V8M-COMMON-NEXT: add sp, #16 ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_i65: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: sub sp, #16 ++; V81M-COMMON-NEXT: add sp, #4 ++; V81M-COMMON-NEXT: stm.w sp, {r0, r1, r2, r3} ++; V81M-LE-NEXT: ldrb.w r0, [sp, #8] ++; V81M-LE-NEXT: and r0, r0, #1 ++; V81M-LE-NEXT: rsbs r0, r0, #0 ++; V81M-BE-NEXT: movs r1, #0 ++; V81M-BE-NEXT: sub.w r0, r1, r0, lsr #24 ++; V81M-COMMON-NEXT: sub sp, #4 ++; V81M-COMMON-NEXT: add sp, #16 ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %arg = load i65, ptr %0, align 8 ++ %shr = ashr i65 %arg, 64 ++ %conv = trunc nsw i65 %shr to i32 ++ ret i32 %conv ++} ++ ++define i32 @access_u65(ptr byval(i65) %0) "cmse_nonsecure_entry" { ++; V8M-COMMON-LABEL: access_u65: ++; V8M-COMMON: @ %bb.0: @ %entry ++; V8M-COMMON-NEXT: sub sp, #16 ++; V8M-COMMON-NEXT: stm.w sp, {r0, r1, r2, r3} ++; V8M-LE-NEXT: ldrb.w r0, [sp, #8] ++; V8M-BE-NEXT: lsrs r0, r0, #24 ++; V8M-COMMON-NEXT: add sp, #16 ++; V8M-COMMON-NEXT: mov r1, lr ++; V8M-COMMON-NEXT: mov r2, lr ++; V8M-COMMON-NEXT: mov r3, lr ++; V8M-COMMON-NEXT: mov r12, lr ++; V8M-COMMON-NEXT: msr apsr_nzcvq, lr ++; V8M-COMMON-NEXT: bxns lr ++; ++; V81M-COMMON-LABEL: access_u65: ++; V81M-COMMON: @ %bb.0: @ %entry ++; V81M-COMMON-NEXT: vstr fpcxtns, [sp, #-4]! ++; V81M-COMMON-NEXT: sub sp, #16 ++; V81M-COMMON-NEXT: add sp, #4 ++; V81M-COMMON-NEXT: stm.w sp, {r0, r1, r2, r3} ++; V81M-LE-NEXT: ldrb.w r0, [sp, #8] ++; V81M-BE-NEXT: lsrs r0, r0, #24 ++; V81M-COMMON-NEXT: sub sp, #4 ++; V81M-COMMON-NEXT: add sp, #16 ++; V81M-COMMON-NEXT: vscclrm {s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15, vpr} ++; V81M-COMMON-NEXT: vldr fpcxtns, [sp], #4 ++; V81M-COMMON-NEXT: clrm {r1, r2, r3, r12, apsr} ++; V81M-COMMON-NEXT: bxns lr ++entry: ++ %arg = load i65, ptr %0, align 8 ++ %shr = lshr i65 %arg, 64 ++ %conv = trunc nuw nsw i65 %shr to i32 ++ ret i32 %conv ++} diff --git a/meta/recipes-devtools/rust/rust-llvm_1.75.0.bb b/meta/recipes-devtools/rust/rust-llvm_1.75.0.bb index 13bdadb5e7..292fc15c55 100644 --- a/meta/recipes-devtools/rust/rust-llvm_1.75.0.bb +++ b/meta/recipes-devtools/rust/rust-llvm_1.75.0.bb @@ -10,7 +10,8 @@ require rust-source.inc SRC_URI += "file://0002-llvm-allow-env-override-of-exe-path.patch;striplevel=2 \ file://0001-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch;striplevel=2 \ - file://0003-llvm-fix-include-benchmarks.patch;striplevel=2" + file://0003-llvm-fix-include-benchmarks.patch;striplevel=2 \ + file://0004-llvm-Fix-CVE-2024-0151.patch;striplevel=2" S = "${RUSTSRC}/src/llvm-project/llvm" -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 04/10] orc: upgrade 0.4.39 -> 0.4.40 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (2 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 03/10] rust-llvm: Fix CVE-2024-0151 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 05/10] go: upgrade 1.22.6 -> 1.22.7 Steve Sakoman ` (5 subsequent siblings) 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Wang Mingyu <wangmy@fujitsu.com> Changelog: =========== - Security: Minor follow-up fixes for CVE-2024-40897 - powerpc: fix div255w which still used the inexact substitution - x86: work around old GCC versions (pre 9.0) having broken xgetbv implementations - x86: consider MSYS2/Cygwin as Windows for ABI purposes only - x86: handle unnatural and misaligned array pointers - orccodemem: Assorted memory mapping fixes - Fix include header use from C++ - Some compatibility fixes for Musl - ppc: Disable VSX and ISA 2.07 for Apple targets - ppc: Allow detection of ppc64 in Mac OS - x86: Fix non-C11 typedefs - meson: Fix detecting XSAVE on older AppleClang - x86: try fixing AVX detection again by adding check for XSAVE - Check return values of malloc() and realloc() Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ed7e4eb12491968c5f962b7e89d557c2c6d86a33) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-devtools/orc/{orc_0.4.39.bb => orc_0.4.40.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-devtools/orc/{orc_0.4.39.bb => orc_0.4.40.bb} (92%) diff --git a/meta/recipes-devtools/orc/orc_0.4.39.bb b/meta/recipes-devtools/orc/orc_0.4.40.bb similarity index 92% rename from meta/recipes-devtools/orc/orc_0.4.39.bb rename to meta/recipes-devtools/orc/orc_0.4.40.bb index 320abf536a..e437831cd7 100644 --- a/meta/recipes-devtools/orc/orc_0.4.39.bb +++ b/meta/recipes-devtools/orc/orc_0.4.40.bb @@ -5,7 +5,7 @@ LICENSE = "BSD-2-Clause & BSD-3-Clause" LIC_FILES_CHKSUM = "file://COPYING;md5=1400bd9d09e8af56b9ec982b3d85797e" SRC_URI = "http://gstreamer.freedesktop.org/src/orc/orc-${PV}.tar.xz" -SRC_URI[sha256sum] = "33ed2387f49b825fa1b9c3b0072e05f259141b895474ad085ae51143d3040cc0" +SRC_URI[sha256sum] = "3fc2bee78dfb7c41fd9605061fc69138db7df007eae2f669a1f56e8bacef74ab" inherit meson pkgconfig gtk-doc -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 05/10] go: upgrade 1.22.6 -> 1.22.7 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (3 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 04/10] orc: upgrade 0.4.39 -> 0.4.40 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 06/10] go: upgrade 1.22.7 -> 1.22.8 Steve Sakoman ` (4 subsequent siblings) 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Peter Marko <peter.marko@siemens.com> Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.6..go1.22.7 7529d09a11 (tag: go1.22.7) [release-branch.go1.22] go1.22.7 d4c53812e6 [release-branch.go1.22] go/build/constraint: add parsing limits 2092294f2b [release-branch.go1.22] encoding/gob: cover missed cases when checking ignore depth b232596139 [release-branch.go1.22] go/parser: track depth in nested element lists e87be9833e [release-branch.go1.22] runtime: on AIX, fix call to _cgo_sys_thread_create in _rt0_ppc64_aix_lib 676d6100d8 [release-branch.go1.22] cmd/fix: support go versions with patch release 0a525a3ed0 [release-branch.go1.22] os: fix Chtimes test flakes Fixes CVE-2024-34155, CVE-2024-34156 and CVE-2024-34158 [1] https://github.com/golang/go/compare/go1.22.6...go1.22.7 (From OE-Core rev: 92d609c49c0870ca10fcc39d52a801109d65a98b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-devtools/go/{go-1.22.6.inc => go-1.22.7.inc} | 2 +- ...o-binary-native_1.22.6.bb => go-binary-native_1.22.7.bb} | 6 +++--- ...cross-canadian_1.22.6.bb => go-cross-canadian_1.22.7.bb} | 0 .../go/{go-cross_1.22.6.bb => go-cross_1.22.7.bb} | 0 .../go/{go-crosssdk_1.22.6.bb => go-crosssdk_1.22.7.bb} | 0 .../go/{go-runtime_1.22.6.bb => go-runtime_1.22.7.bb} | 0 meta/recipes-devtools/go/{go_1.22.6.bb => go_1.22.7.bb} | 0 7 files changed, 4 insertions(+), 4 deletions(-) rename meta/recipes-devtools/go/{go-1.22.6.inc => go-1.22.7.inc} (89%) rename meta/recipes-devtools/go/{go-binary-native_1.22.6.bb => go-binary-native_1.22.7.bb} (78%) rename meta/recipes-devtools/go/{go-cross-canadian_1.22.6.bb => go-cross-canadian_1.22.7.bb} (100%) rename meta/recipes-devtools/go/{go-cross_1.22.6.bb => go-cross_1.22.7.bb} (100%) rename meta/recipes-devtools/go/{go-crosssdk_1.22.6.bb => go-crosssdk_1.22.7.bb} (100%) rename meta/recipes-devtools/go/{go-runtime_1.22.6.bb => go-runtime_1.22.7.bb} (100%) rename meta/recipes-devtools/go/{go_1.22.6.bb => go_1.22.7.bb} (100%) diff --git a/meta/recipes-devtools/go/go-1.22.6.inc b/meta/recipes-devtools/go/go-1.22.7.inc similarity index 89% rename from meta/recipes-devtools/go/go-1.22.6.inc rename to meta/recipes-devtools/go/go-1.22.7.inc index 834debaf9b..e54a902741 100644 --- a/meta/recipes-devtools/go/go-1.22.6.inc +++ b/meta/recipes-devtools/go/go-1.22.7.inc @@ -15,4 +15,4 @@ SRC_URI += "\ file://0008-src-cmd-dist-buildgo.go-do-not-hardcode-host-compile.patch \ file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \ " -SRC_URI[main.sha256sum] = "9e48d99d519882579917d8189c17e98c373ce25abaebb98772e2927088992a51" +SRC_URI[main.sha256sum] = "66432d87d85e0cfac3edffe637d5930fc4ddf5793313fe11e4a0f333023c879f" diff --git a/meta/recipes-devtools/go/go-binary-native_1.22.6.bb b/meta/recipes-devtools/go/go-binary-native_1.22.7.bb similarity index 78% rename from meta/recipes-devtools/go/go-binary-native_1.22.6.bb rename to meta/recipes-devtools/go/go-binary-native_1.22.7.bb index ea4577f20a..aba317fd38 100644 --- a/meta/recipes-devtools/go/go-binary-native_1.22.6.bb +++ b/meta/recipes-devtools/go/go-binary-native_1.22.7.bb @@ -9,9 +9,9 @@ PROVIDES = "go-native" # Checksums available at https://go.dev/dl/ SRC_URI = "https://dl.google.com/go/go${PV}.${BUILD_GOOS}-${BUILD_GOARCH}.tar.gz;name=go_${BUILD_GOTUPLE}" -SRC_URI[go_linux_amd64.sha256sum] = "999805bed7d9039ec3da1a53bfbcafc13e367da52aa823cb60b68ba22d44c616" -SRC_URI[go_linux_arm64.sha256sum] = "c15fa895341b8eaf7f219fada25c36a610eb042985dc1a912410c1c90098eaf2" -SRC_URI[go_linux_ppc64le.sha256sum] = "9d99fce3f6f72a76630fe91ec0884dfe3db828def4713368424900fa98bb2bd6" +SRC_URI[go_linux_amd64.sha256sum] = "fc5d49b7a5035f1f1b265c17aa86e9819e6dc9af8260ad61430ee7fbe27881bb" +SRC_URI[go_linux_arm64.sha256sum] = "ed695684438facbd7e0f286c30b7bc2411cfc605516d8127dc25c62fe5b03885" +SRC_URI[go_linux_ppc64le.sha256sum] = "a6441d5da40a961039ec22b0aadbc8b513f52b31bb8919c359a7e2c3c5bcf26a" UPSTREAM_CHECK_URI = "https://golang.org/dl/" UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux" diff --git a/meta/recipes-devtools/go/go-cross-canadian_1.22.6.bb b/meta/recipes-devtools/go/go-cross-canadian_1.22.7.bb similarity index 100% rename from meta/recipes-devtools/go/go-cross-canadian_1.22.6.bb rename to meta/recipes-devtools/go/go-cross-canadian_1.22.7.bb diff --git a/meta/recipes-devtools/go/go-cross_1.22.6.bb b/meta/recipes-devtools/go/go-cross_1.22.7.bb similarity index 100% rename from meta/recipes-devtools/go/go-cross_1.22.6.bb rename to meta/recipes-devtools/go/go-cross_1.22.7.bb diff --git a/meta/recipes-devtools/go/go-crosssdk_1.22.6.bb b/meta/recipes-devtools/go/go-crosssdk_1.22.7.bb similarity index 100% rename from meta/recipes-devtools/go/go-crosssdk_1.22.6.bb rename to meta/recipes-devtools/go/go-crosssdk_1.22.7.bb diff --git a/meta/recipes-devtools/go/go-runtime_1.22.6.bb b/meta/recipes-devtools/go/go-runtime_1.22.7.bb similarity index 100% rename from meta/recipes-devtools/go/go-runtime_1.22.6.bb rename to meta/recipes-devtools/go/go-runtime_1.22.7.bb diff --git a/meta/recipes-devtools/go/go_1.22.6.bb b/meta/recipes-devtools/go/go_1.22.7.bb similarity index 100% rename from meta/recipes-devtools/go/go_1.22.6.bb rename to meta/recipes-devtools/go/go_1.22.7.bb -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 06/10] go: upgrade 1.22.7 -> 1.22.8 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (4 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 05/10] go: upgrade 1.22.6 -> 1.22.7 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 07/10] python3-lxml=v5.0.2 Steve Sakoman ` (3 subsequent siblings) 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Peter Marko <peter.marko@siemens.com> Upgrade to latest 1.22.x release [1]: $ git --no-pager log --oneline go1.22.7..go1.22.8 aeccd613c8 (tag: go1.22.8) [release-branch.go1.22] go1.22.8 b4086b7c16 [release-branch.go1.22] syscall: skip TestAmbientCapsUserns when restricted, document 6fab4b9a9e [release-branch.go1.22] runtime: size maps.Clone destination bucket array safely 71655f14ce [release-branch.go1.22] cmd/cgo: correct padding required by alignment [1] https://github.com/golang/go/compare/go1.22.7...go1.22.8 (From OE-Core rev: 552b9913b25107d7a34611b499b7811896b5f098) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-devtools/go/{go-1.22.7.inc => go-1.22.8.inc} | 2 +- ...o-binary-native_1.22.7.bb => go-binary-native_1.22.8.bb} | 6 +++--- ...cross-canadian_1.22.7.bb => go-cross-canadian_1.22.8.bb} | 0 .../go/{go-cross_1.22.7.bb => go-cross_1.22.8.bb} | 0 .../go/{go-crosssdk_1.22.7.bb => go-crosssdk_1.22.8.bb} | 0 .../go/{go-runtime_1.22.7.bb => go-runtime_1.22.8.bb} | 0 meta/recipes-devtools/go/{go_1.22.7.bb => go_1.22.8.bb} | 0 7 files changed, 4 insertions(+), 4 deletions(-) rename meta/recipes-devtools/go/{go-1.22.7.inc => go-1.22.8.inc} (89%) rename meta/recipes-devtools/go/{go-binary-native_1.22.7.bb => go-binary-native_1.22.8.bb} (78%) rename meta/recipes-devtools/go/{go-cross-canadian_1.22.7.bb => go-cross-canadian_1.22.8.bb} (100%) rename meta/recipes-devtools/go/{go-cross_1.22.7.bb => go-cross_1.22.8.bb} (100%) rename meta/recipes-devtools/go/{go-crosssdk_1.22.7.bb => go-crosssdk_1.22.8.bb} (100%) rename meta/recipes-devtools/go/{go-runtime_1.22.7.bb => go-runtime_1.22.8.bb} (100%) rename meta/recipes-devtools/go/{go_1.22.7.bb => go_1.22.8.bb} (100%) diff --git a/meta/recipes-devtools/go/go-1.22.7.inc b/meta/recipes-devtools/go/go-1.22.8.inc similarity index 89% rename from meta/recipes-devtools/go/go-1.22.7.inc rename to meta/recipes-devtools/go/go-1.22.8.inc index e54a902741..542519b930 100644 --- a/meta/recipes-devtools/go/go-1.22.7.inc +++ b/meta/recipes-devtools/go/go-1.22.8.inc @@ -15,4 +15,4 @@ SRC_URI += "\ file://0008-src-cmd-dist-buildgo.go-do-not-hardcode-host-compile.patch \ file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \ " -SRC_URI[main.sha256sum] = "66432d87d85e0cfac3edffe637d5930fc4ddf5793313fe11e4a0f333023c879f" +SRC_URI[main.sha256sum] = "df12c23ebf19dea0f4bf46a22cbeda4a3eca6f474f318390ce774974278440b8" diff --git a/meta/recipes-devtools/go/go-binary-native_1.22.7.bb b/meta/recipes-devtools/go/go-binary-native_1.22.8.bb similarity index 78% rename from meta/recipes-devtools/go/go-binary-native_1.22.7.bb rename to meta/recipes-devtools/go/go-binary-native_1.22.8.bb index aba317fd38..98799eb503 100644 --- a/meta/recipes-devtools/go/go-binary-native_1.22.7.bb +++ b/meta/recipes-devtools/go/go-binary-native_1.22.8.bb @@ -9,9 +9,9 @@ PROVIDES = "go-native" # Checksums available at https://go.dev/dl/ SRC_URI = "https://dl.google.com/go/go${PV}.${BUILD_GOOS}-${BUILD_GOARCH}.tar.gz;name=go_${BUILD_GOTUPLE}" -SRC_URI[go_linux_amd64.sha256sum] = "fc5d49b7a5035f1f1b265c17aa86e9819e6dc9af8260ad61430ee7fbe27881bb" -SRC_URI[go_linux_arm64.sha256sum] = "ed695684438facbd7e0f286c30b7bc2411cfc605516d8127dc25c62fe5b03885" -SRC_URI[go_linux_ppc64le.sha256sum] = "a6441d5da40a961039ec22b0aadbc8b513f52b31bb8919c359a7e2c3c5bcf26a" +SRC_URI[go_linux_amd64.sha256sum] = "5f467d29fc67c7ae6468cb6ad5b047a274bae8180cac5e0b7ddbfeba3e47e18f" +SRC_URI[go_linux_arm64.sha256sum] = "5c616b32dab04bb8c4c8700478381daea0174dc70083e4026321163879278a4a" +SRC_URI[go_linux_ppc64le.sha256sum] = "c546f27866510bf8e54e86fe6f58c705af0e894341e5572c91f197a734152c27" UPSTREAM_CHECK_URI = "https://golang.org/dl/" UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux" diff --git a/meta/recipes-devtools/go/go-cross-canadian_1.22.7.bb b/meta/recipes-devtools/go/go-cross-canadian_1.22.8.bb similarity index 100% rename from meta/recipes-devtools/go/go-cross-canadian_1.22.7.bb rename to meta/recipes-devtools/go/go-cross-canadian_1.22.8.bb diff --git a/meta/recipes-devtools/go/go-cross_1.22.7.bb b/meta/recipes-devtools/go/go-cross_1.22.8.bb similarity index 100% rename from meta/recipes-devtools/go/go-cross_1.22.7.bb rename to meta/recipes-devtools/go/go-cross_1.22.8.bb diff --git a/meta/recipes-devtools/go/go-crosssdk_1.22.7.bb b/meta/recipes-devtools/go/go-crosssdk_1.22.8.bb similarity index 100% rename from meta/recipes-devtools/go/go-crosssdk_1.22.7.bb rename to meta/recipes-devtools/go/go-crosssdk_1.22.8.bb diff --git a/meta/recipes-devtools/go/go-runtime_1.22.7.bb b/meta/recipes-devtools/go/go-runtime_1.22.8.bb similarity index 100% rename from meta/recipes-devtools/go/go-runtime_1.22.7.bb rename to meta/recipes-devtools/go/go-runtime_1.22.8.bb diff --git a/meta/recipes-devtools/go/go_1.22.7.bb b/meta/recipes-devtools/go/go_1.22.8.bb similarity index 100% rename from meta/recipes-devtools/go/go_1.22.7.bb rename to meta/recipes-devtools/go/go_1.22.8.bb -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 07/10] python3-lxml=v5.0.2 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (5 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 06/10] go: upgrade 1.22.7 -> 1.22.8 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 08/10] xserver-xorg: upgrade 21.1.13 -> 21.1.14 Steve Sakoman ` (2 subsequent siblings) 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Martin Jansa <martin.jansa@gmail.com> * minor upgrade to fix building with gcc-14 on host * contains 31 commits: https://github.com/lxml/lxml/compare/lxml-5.0.0...lxml-5.0.2 the important one for gcc-14 is: https://github.com/lxml/lxml/commit/663041a56a075a8fa1e6ca13ba4c6d1de7043ac2 * https://bugs.launchpad.net/lxml/+bug/2045435 * https://bugs.gentoo.org/917562 Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../python/{python3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) rename meta/recipes-devtools/python/{python3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} (94%) diff --git a/meta/recipes-devtools/python/python3-lxml_5.0.0.bb b/meta/recipes-devtools/python/python3-lxml_5.0.2.bb similarity index 94% rename from meta/recipes-devtools/python/python3-lxml_5.0.0.bb rename to meta/recipes-devtools/python/python3-lxml_5.0.2.bb index 66cb8b0938..c0b385c7ea 100644 --- a/meta/recipes-devtools/python/python3-lxml_5.0.0.bb +++ b/meta/recipes-devtools/python/python3-lxml_5.0.2.bb @@ -18,11 +18,10 @@ LIC_FILES_CHKSUM = "file://LICENSES.txt;md5=e4c045ebad958ead4b48008f70838403 \ DEPENDS += "libxml2 libxslt" -SRC_URI[sha256sum] = "2219cbf790e701acf9a21a31ead75f983e73daf0eceb9da6990212e4d20ebefe" +SRC_URI[sha256sum] = "6399703c40ba53e2c3b72fdb56cb908d2b83c08082ecf17de839b27e68d1e598" SRC_URI += "${PYPI_SRC_URI}" inherit pkgconfig pypi setuptools3 -PYPI_PACKAGE_EXT = "zip" # {standard input}: Assembler messages: # {standard input}:1488805: Error: branch out of range -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 08/10] xserver-xorg: upgrade 21.1.13 -> 21.1.14 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (6 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 07/10] python3-lxml=v5.0.2 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 09/10] e2fsprogs: removed 'sed -u' option Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 10/10] weston: backport patch to allow neatvnc < v0.9.0 Steve Sakoman 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Vijay Anusuri <vanusuri@mvista.com> Includes security fix CVE-2024-9632 Ref: https://lists.x.org/archives/xorg/2024-October/061765.html Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 957ba32bc6fdffd3a796a04ba222fae6cd673f7e) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../{xserver-xorg_21.1.13.bb => xserver-xorg_21.1.14.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.13.bb => xserver-xorg_21.1.14.bb} (92%) diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.13.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.14.bb similarity index 92% rename from meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.13.bb rename to meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.14.bb index 1f18c22fa8..28c98eb527 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.13.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.14.bb @@ -3,7 +3,7 @@ require xserver-xorg.inc SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \ file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \ " -SRC_URI[sha256sum] = "b45a02d5943f72236a360d3cc97e75134aa4f63039ff88c04686b508a3dc740c" +SRC_URI[sha256sum] = "8f2102cebdc4747d1656c1099ef610f5063c7422c24a177e300de569b354ee35" # These extensions are now integrated into the server, so declare the migration # path for in-place upgrades. -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 09/10] e2fsprogs: removed 'sed -u' option 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (7 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 08/10] xserver-xorg: upgrade 21.1.13 -> 21.1.14 Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 10/10] weston: backport patch to allow neatvnc < v0.9.0 Steve Sakoman 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Aditya Tayade <Aditya.Tayade@kpit.com> In embedded box, sed might be provided another providers like Busybox, hence use generic options whenever possible. /bin/sed -> /etc/alternatives/sed /etc/alternatives/sed -> /bin/busybox.nosuid Here used 'sed -u' option is not necessary, hence removed it. Fixes below error: sed: invalid option -- 'u' Also added 'set -eux' option which halts execution of the script on any failures. Signed-off-by: Aditya Tayade <Aditya.Tayade@kpit.com> Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 07caee1829d2a61bc018fe0e37ecd482922179ee) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest b/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest index 279923db8e..1857a17189 100644 --- a/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest +++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest @@ -1,7 +1,8 @@ #!/bin/sh +set -eux cd ./test -SKIP_SLOW_TESTS=yes ./test_script | sed -u -e '/:[[:space:]]ok/s/^/PASS: /' -e '/:[[:space:]]failed/s/^/FAIL: /' -e '/:[[:space:]]skipped/s/^/SKIP: /' +SKIP_SLOW_TESTS=yes ./test_script | sed -e '/:[[:space:]]ok/s/^/PASS: /' -e '/:[[:space:]]failed/s/^/FAIL: /' -e '/:[[:space:]]skipped/s/^/SKIP: /' rm -rf /var/volatile/tmp/*e2fsprogs* rm -f tmp-* rm -f *.tmp -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 10/10] weston: backport patch to allow neatvnc < v0.9.0 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (8 preceding siblings ...) 2024-11-07 3:37 ` [OE-core][scarthgap 09/10] e2fsprogs: removed 'sed -u' option Steve Sakoman @ 2024-11-07 3:37 ` Steve Sakoman 9 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw) To: openembedded-core From: Hiago De Franco <hiago.franco@toradex.com> Currently weston 13.0.3 with neatvnc 0.8.1 does not compile when using VNC: | Dependency neatvnc found: NO found 0.8.1 but need: '< 0.8.0' ; matched: '>= 0.7.0' However weston upstream already increased the allowed version to 0.9.0, since neatvnc 0.8.0 does not introduce any changes that breaks API used by the VNC backend. Therefore, backport this patch. Signed-off-by: Hiago De Franco <hiago.franco@toradex.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8516496018a3ee9e81a67d4682bf9784d0eab2bd) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- ...1-vnc-Allow-neatvnc-in-version-0.8.0.patch | 27 +++++++++++++++++++ .../recipes-graphics/wayland/weston_13.0.1.bb | 1 + 2 files changed, 28 insertions(+) create mode 100644 meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch diff --git a/meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch b/meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch new file mode 100644 index 0000000000..4ac1c075fd --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch @@ -0,0 +1,27 @@ +From 534cfa08ea0a0c2646b4aec20b16bf95f6d0aae6 Mon Sep 17 00:00:00 2001 +From: Lukasz Czechowski <lukasz.czechowski@thaumatec.com> +Date: Mon, 3 Jun 2024 13:39:27 +0200 +Subject: [PATCH] vnc: Allow neatvnc in version 0.8.0 + +Neat VNC 0.8.0 does not introduce any changes that breaks API used +by VNC backend, so it is safe to extend compatibility. + +Upstream-Status: Backport [05e5405651054c580b248c4ab2791ed8d66369e3] +Signed-off-by: Lukasz Czechowski <lukasz.czechowski@thaumatec.com> +--- + libweston/backend-vnc/meson.build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libweston/backend-vnc/meson.build b/libweston/backend-vnc/meson.build +index b7b6916..39b15cf 100644 +--- a/libweston/backend-vnc/meson.build ++++ b/libweston/backend-vnc/meson.build +@@ -3,7 +3,7 @@ if not get_option('backend-vnc') + endif + + config_h.set('BUILD_VNC_COMPOSITOR', '1') +-dep_neatvnc = dependency('neatvnc', version: ['>= 0.7.0', '< 0.8.0'], required: false, fallback: ['neatvnc', 'neatvnc_dep']) ++dep_neatvnc = dependency('neatvnc', version: ['>= 0.7.0', '< 0.9.0'], required: false, fallback: ['neatvnc', 'neatvnc_dep']) + if not dep_neatvnc.found() + error('VNC backend requires neatvnc which was not found. Or, you can use \'-Dbackend-vnc=false\'.') + endif diff --git a/meta/recipes-graphics/wayland/weston_13.0.1.bb b/meta/recipes-graphics/wayland/weston_13.0.1.bb index dd9517a4dd..d8f0279b65 100644 --- a/meta/recipes-graphics/wayland/weston_13.0.1.bb +++ b/meta/recipes-graphics/wayland/weston_13.0.1.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d79ee9e66bb0f95d3386a7acae780b70 \ SRC_URI = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${PV}/downloads/${BPN}-${PV}.tar.xz \ file://0001-libweston-tools-Include-libgen.h-for-basename-signat.patch \ + file://0001-vnc-Allow-neatvnc-in-version-0.8.0.patch \ file://weston.png \ file://weston.desktop \ file://xwayland.weston-start \ -- 2.34.1 ^ permalink raw reply related [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 00/10] Patch review @ 2025-08-19 20:07 Steve Sakoman 0 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2025-08-19 20:07 UTC (permalink / raw) To: openembedded-core Please review this set of changes for kirkstone and have comments back by end of day Thursday, August 21 Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2234 The following changes since commit fa45d6d5bec8fe503ff6b9166a3b4af31ea95369: go-helloworld: fix license (2025-08-14 07:34:07 -0700) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut Daniel Turull (2): xz: ignore CVE-2024-47611 libxml2: ignore CVE-2025-8732 Khem Raj (3): e2fsprogs: Fix build failure with gcc 15 parted: Fix build with GCC 15 bash: Stick to C17 std Martin Jansa (2): cairo: fix build with gcc-15 on host bash: use -std=gnu17 also for native CFLAGS Peter Marko (2): dropbear: patch CVE-2025-47203 glib-2.0: ignore CVE-2025-4056 Philip Lorenz (1): cve-check: Add missing call to exit_if_errors meta/classes/cve-check.bbclass | 1 + ...iable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch | 27 ++ ...-length-paths-and-commands-in-multih.patch | 63 +++ ...and-also-forward-this-when-multihop-.patch | 81 ++++ ...add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch | 29 ++ .../dropbear/dropbear/CVE-2025-47203.patch | 367 ++++++++++++++++++ .../recipes-core/dropbear/dropbear_2022.83.bb | 5 + meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 + meta/recipes-core/libxml/libxml2_2.12.10.bb | 4 + ...-libext2fs-fix-std-c23-build-failure.patch | 42 ++ .../e2fsprogs/e2fsprogs_1.47.0.bb | 1 + meta/recipes-extended/bash/bash_5.2.21.bb | 5 + ...CH-parted-fix-do_version-declaration.patch | 40 ++ meta/recipes-extended/parted/parted_3.6.bb | 1 + meta/recipes-extended/xz/xz_5.4.7.bb | 2 + .../cairo/cairo/0001-Require-C11.patch | 25 ++ .../cairo/cairo/0002-Meson-Require-C-11.patch | 22 ++ meta/recipes-graphics/cairo/cairo_1.18.0.bb | 2 + 18 files changed, 719 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch create mode 100644 meta/recipes-core/dropbear/dropbear/0001-add-o-BatchMode-and-also-forward-this-when-multihop-.patch create mode 100644 meta/recipes-core/dropbear/dropbear/0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2025-47203.patch create mode 100644 meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-std-c23-build-failure.patch create mode 100644 meta/recipes-extended/parted/files/0001-bug-74444-PATCH-parted-fix-do_version-declaration.patch create mode 100644 meta/recipes-graphics/cairo/cairo/0001-Require-C11.patch create mode 100644 meta/recipes-graphics/cairo/cairo/0002-Meson-Require-C-11.patch -- 2.43.0 ^ permalink raw reply [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 00/10] Patch review @ 2025-03-27 19:44 Steve Sakoman 0 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2025-03-27 19:44 UTC (permalink / raw) To: openembedded-core Please review this set of changes for scarthgap and have comments back by end of day Monday, March 31 Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1283 The following changes since commit a720df7ad77af1f8b1c00a211c88537e5f23edbc: nativesdk-libtool: sanitize the script, remove buildpaths (2025-03-20 12:51:41 -0700) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut Bruce Ashfield (6): linux-yocto/6.6: update to v6.6.77 linux-yocto/6.6: update to v6.6.78 linux-yocto/6.6: update to v6.6.80 linux-yocto/6.6: update to v6.6.82 linux-yocto/6.6: update to v6.6.83 linux-yocto/6.6: update to v6.6.84 Divya Chellam (1): ruby: fix CVE-2025-27220 Madhu Marri (1): qemu 8.2.7: ignore CVE-2023-1386 Stefan Mueller-Klieser (1): kernel-arch: add macro-prefix-map in KERNEL_CC Vijay Anusuri (1): vim: Upgrade 9.1.1115 -> 9.1.1198 meta/classes-recipe/kernel-arch.bbclass | 8 +- meta/recipes-devtools/qemu/qemu.inc | 2 + .../ruby/ruby/CVE-2025-27220.patch | 78 +++++++++++++++++++ meta/recipes-devtools/ruby/ruby_3.3.5.bb | 1 + .../linux/linux-yocto-rt_6.6.bb | 6 +- .../linux/linux-yocto-tiny_6.6.bb | 6 +- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++---- meta/recipes-support/vim/vim.inc | 4 +- 8 files changed, 110 insertions(+), 23 deletions(-) create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27220.patch -- 2.43.0 ^ permalink raw reply [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-02-25 20:56 Steve Sakoman
0 siblings, 0 replies; 25+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, February 27
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1081
The following changes since commit fc46705cc629a151f85717a57f7d789de8fd9b64:
icu: remove host references in nativesdk to fix reproducibility (2025-02-19 06:28:10 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Etienne Cordonnier (1):
python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES
Hitendra Prajapati (1):
libcap: fix CVE-2025-1390
Hongxu Jia (6):
u-boot: fix CVE-2024-57254
u-boot: fix CVE-2024-57255
u-boot: fix CVE-2024-57256
u-boot: fix CVE-2024-57257
u-boot: fix CVE-2024-57258
u-boot: fix CVE-2024-57259
Peter Marko (1):
libxml2: upgrade 2.12.9 -> 2.12.10
Vijay Anusuri (1):
bind: Upgrade 9.18.28 -> 9.18.33
.../u-boot/files/CVE-2024-57254.patch | 47 ++++
.../u-boot/files/CVE-2024-57255.patch | 53 ++++
.../u-boot/files/CVE-2024-57256.patch | 51 ++++
.../u-boot/files/CVE-2024-57257.patch | 227 ++++++++++++++++++
.../u-boot/files/CVE-2024-57258-1.patch | 47 ++++
.../u-boot/files/CVE-2024-57258-2.patch | 43 ++++
.../u-boot/files/CVE-2024-57258-3.patch | 40 +++
.../u-boot/files/CVE-2024-57259.patch | 41 ++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 11 +-
.../bind/{bind_9.18.28.bb => bind_9.18.33.bb} | 2 +-
.../{libxml2_2.12.9.bb => libxml2_2.12.10.bb} | 2 +-
...0001-respect-GIT_CEILING_DIRECTORIES.patch | 36 +++
.../python/python3-setuptools-scm_8.0.4.bb | 1 +
.../libcap/files/CVE-2025-1390.patch | 36 +++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
15 files changed, 635 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
rename meta/recipes-connectivity/bind/{bind_9.18.28.bb => bind_9.18.33.bb} (97%)
rename meta/recipes-core/libxml/{libxml2_2.12.9.bb => libxml2_2.12.10.bb} (97%)
create mode 100644 meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2025-1390.patch
--
2.43.0
^ permalink raw reply [flat|nested] 25+ messages in thread* [OE-core][scarthgap 00/10] Patch review @ 2024-12-18 22:02 Steve Sakoman 0 siblings, 0 replies; 25+ messages in thread From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw) To: openembedded-core Please review this set of changes for scarthgap and have comments back by end of day Friday, December 20 Passed a-full on autobuilder: https://valkyrie.yoctoproject.org/#/builders/29/builds/674 The following changes since commit b19b1e905d966443c4e4d17dfaeb299ae2526575: cve-update-nvd2-native: Tweak to work better with NFS DL_DIR (2024-12-18 06:41:14 -0800) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut Alexander Kanavin (1): rust: add reproducibility patch to eliminate host leakage Archana Polampalli (3): ffmpeg: fix CVE-2024-35366 ffmpeg: fix CVE-2024-35367 ffmpeg: fix CVE-2024-35368 Hongxu Jia (1): kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12 Jiaying Song (1): subversion: fix CVE-2024-46901 Khem Raj (1): python3: Drop empty patch Ross Burton (1): python3: add dependency on -compression to -core Sunil Dora (1): gcc: Fix c++: tweak for Wrange-loop-construct Yash Shinde (1): binutils: Fix CVE-2024-53589 .../binutils/binutils-2.42.inc | 1 + .../binutils/0016-CVE-2024-53589.patch | 92 ++++++++++ meta/recipes-devtools/gcc/gcc-13.3.inc | 1 + ...ix-c-tweak-for-Wrange-loop-construct.patch | 113 ++++++++++++ ...lize-struct-termios-before-calling-t.patch | 26 --- .../python/python3/python3-manifest.json | 2 +- .../recipes-devtools/python/python3_3.12.6.bb | 1 - ...te-host-information-into-compilation.patch | 51 ++++++ meta/recipes-devtools/rust/rust-source.inc | 1 + .../subversion/CVE-2024-46901.patch | 161 ++++++++++++++++++ .../subversion/subversion_1.14.3.bb | 3 +- ...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++ .../kern-tools/kern-tools-native_git.bb | 4 +- .../ffmpeg/ffmpeg/CVE-2024-35366.patch | 35 ++++ .../ffmpeg/ffmpeg/CVE-2024-35367.patch | 47 +++++ .../ffmpeg/ffmpeg/CVE-2024-35368.patch | 41 +++++ .../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 3 + 17 files changed, 612 insertions(+), 30 deletions(-) create mode 100644 meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch create mode 100644 meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch delete mode 100644 meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch create mode 100644 meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch create mode 100644 meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch create mode 100644 meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch -- 2.34.1 ^ permalink raw reply [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-10-07 1:54 Steve Sakoman
2024-10-07 3:23 ` Khem Raj
0 siblings, 1 reply; 25+ messages in thread
From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, October 8
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374
The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b:
makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepesh Varatharajan (1):
glibc: stable 2.39 branch updates.
Hitendra Prajapati (1):
webkitgtk: upgrade 2.44.1 -> 2.44.3
Khem Raj (2):
gnupg: Document CVE-2022-3219 and mark wontfix
openssh: Mark CVE-2023-51767 as wont-fix
Martin Jansa (2):
populate_sdk_base: inherit nopackages
meta-world-pkgdata: Inherit nopackages
Peter Marko (3):
wpa-supplicant: Ignore CVE-2024-5290
wpa-supplicant: Patch CVE-2024-3596
wpa-supplicant: Patch security advisory 2024-2
Wang Mingyu (1):
cryptodev: upgrade 1.13 -> 1.14
meta/classes-recipe/populate_sdk_base.bbclass | 2 +-
.../openssh/openssh_9.6p1.bb | 1 +
...valid-Rejected-Groups-element-length.patch | 52 ++++++
...valid-Rejected-Groups-element-length.patch | 50 ++++++
...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++
.../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++
.../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++
.../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++
.../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++
.../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++
.../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++
.../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++
.../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++
.../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++
.../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/meta/meta-world-pkgdata.bb | 1 +
...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0
...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 -
...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 -
meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-
...ng-header-file-provided-by-another-p.patch | 25 ---
...001-tests-Makefile-do-not-use-Werror.patch | 25 ---
...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +-
...spection.cmake-prefix-variables-obta.patch | 2 +-
...fic-declarations-in-FELighting.h-unn.patch | 44 -----
...icDowncast-adoption-in-platform-code.patch | 65 -------
...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +-
.../webkit/webkitgtk/no-musttail-arm.patch | 6 +-
.../webkit/webkitgtk/reproducibility.patch | 2 +-
.../webkit/webkitgtk/t6-not-declared.patch | 12 +-
...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +-
meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 +
33 files changed, 786 insertions(+), 190 deletions(-)
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%)
rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%)
rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%)
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch
rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%)
--
2.34.1
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: [OE-core][scarthgap 00/10] Patch review 2024-10-07 1:54 Steve Sakoman @ 2024-10-07 3:23 ` Khem Raj 0 siblings, 0 replies; 25+ messages in thread From: Khem Raj @ 2024-10-07 3:23 UTC (permalink / raw) To: steve; +Cc: openembedded-core series looks ok to me. On Sun, Oct 6, 2024 at 6:55 PM Steve Sakoman via lists.openembedded.org <steve=sakoman.com@lists.openembedded.org> wrote: > > Please review this set of changes for scarthgap and have comments back by > end of day Tuesday, October 8 > > Passed a-full on autobuilder: > > https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374 > > The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b: > > makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700) > > are available in the Git repository at: > > https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut > https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut > > Deepesh Varatharajan (1): > glibc: stable 2.39 branch updates. > > Hitendra Prajapati (1): > webkitgtk: upgrade 2.44.1 -> 2.44.3 > > Khem Raj (2): > gnupg: Document CVE-2022-3219 and mark wontfix > openssh: Mark CVE-2023-51767 as wont-fix > > Martin Jansa (2): > populate_sdk_base: inherit nopackages > meta-world-pkgdata: Inherit nopackages > > Peter Marko (3): > wpa-supplicant: Ignore CVE-2024-5290 > wpa-supplicant: Patch CVE-2024-3596 > wpa-supplicant: Patch security advisory 2024-2 > > Wang Mingyu (1): > cryptodev: upgrade 1.13 -> 1.14 > > meta/classes-recipe/populate_sdk_base.bbclass | 2 +- > .../openssh/openssh_9.6p1.bb | 1 + > ...valid-Rejected-Groups-element-length.patch | 52 ++++++ > ...valid-Rejected-Groups-element-length.patch | 50 ++++++ > ...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++ > .../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++ > .../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++ > .../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++ > .../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++ > .../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++ > .../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++ > .../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++ > .../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++ > .../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++ > .../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++ > meta/recipes-core/glibc/glibc-version.inc | 2 +- > meta/recipes-core/meta/meta-world-pkgdata.bb | 1 + > ...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0 > ...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 - > ...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 - > meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +- > ...ng-header-file-provided-by-another-p.patch | 25 --- > ...001-tests-Makefile-do-not-use-Werror.patch | 25 --- > ...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +- > ...spection.cmake-prefix-variables-obta.patch | 2 +- > ...fic-declarations-in-FELighting.h-unn.patch | 44 ----- > ...icDowncast-adoption-in-platform-code.patch | 65 ------- > ...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +- > .../webkit/webkitgtk/no-musttail-arm.patch | 6 +- > .../webkit/webkitgtk/reproducibility.patch | 2 +- > .../webkit/webkitgtk/t6-not-declared.patch | 12 +- > ...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +- > meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 + > 33 files changed, 786 insertions(+), 190 deletions(-) > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch > rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%) > rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%) > rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%) > delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch > delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch > delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch > delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch > rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%) > > -- > 2.34.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#205248): https://lists.openembedded.org/g/openembedded-core/message/205248 > Mute This Topic: https://lists.openembedded.org/mt/108861069/1997914 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > ^ permalink raw reply [flat|nested] 25+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-08-08 2:28 Steve Sakoman
0 siblings, 0 replies; 25+ messages in thread
From: Steve Sakoman @ 2024-08-08 2:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, August 9
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7220
with the exception of a load related parsing failure on qemuarm64-armhost
which passed on subsequent re-test:
https://autobuilder.yoctoproject.org/typhoon/#/builders/97/builds/8717
The following changes since commit 136a25567499191b23a4d000a06bf83a473224ca:
rust: Add new varaible RUST_ENABLE_EXTRA_TOOLS (2024-08-03 11:45:57 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Archana Polampalli (1):
ffmpeg: fix CVE-2024-31582
Ashish Sharma (1):
bind: Upgrade 9.18.25 -> 9.18.28
Changqing Li (2):
curl: correct the PACKAGECONFIG for native/nativesdk
libpng: update SRC_URI
Peter Marko (4):
curl: Patch CVE-2024-6197
glibc: cleanup old cve status
qemu: set cve status for CVE-2023-6683
libmnl: explicitly disable doxygen
Richard Purdie (1):
nasm: Upgrade 2.16.01 -> 2.16.03
Wang Mingyu (1):
orc: upgrade 0.4.38 -> 0.4.39
.../bind/{bind_9.18.25.bb => bind_9.18.28.bb} | 2 +-
meta/recipes-core/glibc/glibc-version.inc | 2 --
.../nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} | 2 +-
.../orc/{orc_0.4.38.bb => orc_0.4.39.bb} | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 2 ++
meta/recipes-extended/libmnl/libmnl_1.0.5.bb | 2 ++
.../ffmpeg/ffmpeg/CVE-2024-31582.patch | 34 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
.../libpng/libpng_1.6.42.bb | 2 +-
.../curl/curl/CVE-2024-6197.patch | 24 +++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 5 +--
11 files changed, 70 insertions(+), 8 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.18.25.bb => bind_9.18.28.bb} (97%)
rename meta/recipes-devtools/nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} (88%)
rename meta/recipes-devtools/orc/{orc_0.4.38.bb => orc_0.4.39.bb} (92%)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-6197.patch
--
2.34.1
^ permalink raw reply [flat|nested] 25+ messages in thread* [OE-core][scarthgap 00/10] Patch review
@ 2024-06-11 13:07 Steve Sakoman
0 siblings, 0 replies; 25+ messages in thread
From: Steve Sakoman @ 2024-06-11 13:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, June 13.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7024
The following changes since commit a3f5ac9f9fee2c8e10fec7c3f758e49513fef724:
git: set --with-gitconfig=/etc/gitconfig for -native builds (2024-05-31 14:02:17 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepthi Hemraj (1):
gcc : upgrade to v13.3
Lei Maohui (1):
run-postinsts.service: Removed --no-reload to fix reload warning when
users execute systemctl in the first boot.
Mark Hatle (1):
binutils: Fix aarch64 disassembly abort
Martin Hundeb?ll (1):
classes: image_types: quote variable assignment needed by dash
Robert Joslyn (1):
libgloss: Do not apply non-existent patch
Ross Burton (1):
gdk-pixbuf: upgrade 2.42.11 -> 2.42.12
Siddharth (1):
openssl: Upgrade 3.2.1 -> 3.2.2
Soumya Sambu (2):
util-linux: Fix CVE-2024-28085
git: upgrade 2.44.0 -> 2.44.1
Wang Mingyu (1):
gdk-pixbuf: upgrade 2.42.10 -> 2.42.11
meta/classes-recipe/image_types.bbclass | 2 +-
meta/conf/distro/include/maintainers.inc | 2 +-
.../openssl/openssl/CVE-2024-2511.patch | 120 -
.../openssl/openssl/CVE-2024-4603.patch | 179 -
.../openssl/openssl/bti.patch | 58 -
.../{openssl_3.2.1.bb => openssl_3.2.2.bb} | 5 +-
meta/recipes-core/newlib/libgloss_git.bb | 1 -
meta/recipes-core/util-linux/util-linux.inc | 2 +
.../util-linux/CVE-2024-28085-0001.patch | 36 +
.../util-linux/CVE-2024-28085-0002.patch | 34 +
.../binutils/binutils-2.42.inc | 1 +
...sserts-from-operand-qualifier-decode.patch | 382 ++
.../gcc/{gcc-13.2.inc => gcc-13.3.inc} | 9 +-
...ian_13.2.bb => gcc-cross-canadian_13.3.bb} | 0
.../{gcc-cross_13.2.bb => gcc-cross_13.3.bb} | 0
...-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} | 0
...cc-runtime_13.2.bb => gcc-runtime_13.3.bb} | 0
...itizers_13.2.bb => gcc-sanitizers_13.3.bb} | 0
...{gcc-source_13.2.bb => gcc-source_13.3.bb} | 0
...AMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch | 9 +-
...ch64-Fix-loose-ldpstp-check-PR111411.patch | 117 -
.../gcc/gcc/CVE-2023-4039.patch | 3093 -----------------
.../gcc/gcc/CVE-2024-0151.patch | 315 --
.../gcc/{gcc_13.2.bb => gcc_13.3.bb} | 0
...initial_13.2.bb => libgcc-initial_13.3.bb} | 0
.../gcc/{libgcc_13.2.bb => libgcc_13.3.bb} | 0
...ibgfortran_13.2.bb => libgfortran_13.3.bb} | 0
.../git/{git_2.44.0.bb => git_2.44.1.bb} | 2 +-
.../run-postinsts/run-postinsts.service | 2 +-
...w-a-subset-of-tests-in-cross-compile.patch | 10 +-
.../gdk-pixbuf/gdk-pixbuf/fatal-loader.patch | 7 +-
...ixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} | 2 +-
32 files changed, 479 insertions(+), 3909 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-4603.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/bti.patch
rename meta/recipes-connectivity/openssl/{openssl_3.2.1.bb => openssl_3.2.2.bb} (97%)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0001.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0002.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-aarch64-Remove-asserts-from-operand-qualifier-decode.patch
rename meta/recipes-devtools/gcc/{gcc-13.2.inc => gcc-13.3.inc} (94%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_13.2.bb => gcc-cross-canadian_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_13.2.bb => gcc-cross_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_13.2.bb => gcc-runtime_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_13.2.bb => gcc-sanitizers_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_13.2.bb => gcc-source_13.3.bb} (100%)
delete mode 100644 meta/recipes-devtools/gcc/gcc/0026-aarch64-Fix-loose-ldpstp-check-PR111411.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2024-0151.patch
rename meta/recipes-devtools/gcc/{gcc_13.2.bb => gcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_13.2.bb => libgcc-initial_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_13.2.bb => libgcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_13.2.bb => libgfortran_13.3.bb} (100%)
rename meta/recipes-devtools/git/{git_2.44.0.bb => git_2.44.1.bb} (98%)
rename meta/recipes-gnome/gdk-pixbuf/{gdk-pixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} (98%)
--
2.34.1
^ permalink raw reply [flat|nested] 25+ messages in threadend of thread, other threads:[~2025-08-19 20:08 UTC | newest] Thread overview: 25+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-11-07 3:37 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 01/10] cve-check: add support for cvss v4.0 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 02/10] cve_check: Use a local copy of the database during builds Steve Sakoman 2024-11-26 13:02 ` Vincent Prince 2024-11-26 13:18 ` Yoann Congal 2024-11-28 15:58 ` Yoann Congal 2024-11-28 16:08 ` Marta Rybczynska 2024-12-01 13:40 ` Yoann Congal 2024-12-01 16:34 ` Marta Rybczynska 2024-11-07 3:37 ` [OE-core][scarthgap 03/10] rust-llvm: Fix CVE-2024-0151 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 04/10] orc: upgrade 0.4.39 -> 0.4.40 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 05/10] go: upgrade 1.22.6 -> 1.22.7 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 06/10] go: upgrade 1.22.7 -> 1.22.8 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 07/10] python3-lxml=v5.0.2 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 08/10] xserver-xorg: upgrade 21.1.13 -> 21.1.14 Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 09/10] e2fsprogs: removed 'sed -u' option Steve Sakoman 2024-11-07 3:37 ` [OE-core][scarthgap 10/10] weston: backport patch to allow neatvnc < v0.9.0 Steve Sakoman -- strict thread matches above, loose matches on Subject: below -- 2025-08-19 20:07 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2025-03-27 19:44 Steve Sakoman 2025-02-25 20:56 Steve Sakoman 2024-12-18 22:02 Steve Sakoman 2024-10-07 1:54 Steve Sakoman 2024-10-07 3:23 ` Khem Raj 2024-08-08 2:28 Steve Sakoman 2024-06-11 13:07 Steve Sakoman
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.